@firestartr/cli 1.53.0-snapshot-4 → 1.53.0-snapshot-6

package/build/index.js

@@ -354119,7 +354119,7 @@ async function getUserInfo(name) {
 });
 
 ;// CONCATENATED MODULE: ../github/src/sticky_comment.ts
-
+const MAX_MULTIPART_COMMENTS = 100;
 const locks = new Map();
 async function withLock(key, fn) {
     const prev = locks.get(key) ?? Promise.resolve();
@@ -354140,116 +354140,147 @@ async function withLock(key, fn) {
 function escapeForRegex(s) {
     return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 }
-function prIdRegex(kind) {
-    return new RegExp(`<!-- sticky-id:${escapeForRegex(kind)}=(\\d+) -->`);
+function multiPartIdRegex(baseKind, index) {
+    return new RegExp(`<!-- sticky-id:${escapeForRegex(baseKind)}\\[${index}\\]=(\\d+) -->`);
 }
-function prIdMarker(kind, id) {
-    return `<!-- sticky-id:${kind}=${id} -->`;
+function multiPartIdMarker(baseKind, index, id) {
+    return `<!-- sticky-id:${baseKind}[${index}]=${id} -->`;
 }
-function bodyMarker(kind) {
-    return `<!-- sticky:kind=${kind} -->`;
+function multiPartBodyMarker(baseKind, index) {
+    return `<!-- sticky:kind=${baseKind}[${index}] -->`;
 }
-async function readStickyIdFromPrBody(octokit, owner, repo, pr, kind) {
+// ---- Helpers for reducing API calls and duplication ----
+async function getPrBody(octokit, owner, repo, pr) {
     const prResp = await octokit.rest.pulls.get({ owner, repo, pull_number: pr });
-    const body = prResp.data?.body ?? '';
-    const m = body.match(prIdRegex(kind));
-    github_src_logger.info(`readStickyIdFromPrBody: owner=${owner} repo=${repo} pr=${pr} kind=${kind} => id=${m ? m[1] : 'undefined'}`);
-    return m ? Number(m[1]) : undefined;
-}
-async function writeStickyIdToPrBody(octokit, owner, repo, pr, kind, id) {
-    const get = await octokit.rest.pulls.get({ owner, repo, pull_number: pr });
-    const body = get.data?.body ?? '';
-    const rx = prIdRegex(kind);
-    const marker = prIdMarker(kind, id);
-    github_src_logger.info(`writeStickyIdToPrBody: owner=${owner} repo=${repo} pr=${pr} kind=${kind} id=${id}`);
-    const next = rx.test(body)
-        ? body.replace(rx, marker)
-        : body
-            ? `${body}\n${marker}`
-            : marker;
-    if (next !== body) {
+    return prResp.data?.body ?? '';
+}
+async function updatePrBodyIfChanged(octokit, owner, repo, pr, newBody, oldBody) {
+    if (newBody !== oldBody) {
         await octokit.rest.pulls.update({
             owner,
             repo,
             pull_number: pr,
-            body: next,
+            body: newBody,
         });
     }
 }
-async function upsertStickyComment(octokit, params) {
-    const { owner, repo, pullNumber, kind } = params;
-    const fullBody = `${params.body}\n\n${bodyMarker(kind)}`;
-    const lockKey = `${owner}/${repo}#${pullNumber}#${kind}`;
-    await withLock(lockKey, async () => {
-        // 1) PR-body registry fast path
-        const idFromPr = await readStickyIdFromPrBody(octokit, owner, repo, pullNumber, kind);
-        if (idFromPr) {
-            github_src_logger.info(`upsertStickyComment: found existing comment ID ${idFromPr} from PR body for kind=${kind}`);
-            await octokit.rest.issues.updateComment({
-                owner,
-                repo,
-                comment_id: idFromPr,
-                body: fullBody,
-            });
-            return;
+async function updateComment(octokit, owner, repo, commentId, body) {
+    await octokit.rest.issues.updateComment({
+        owner,
+        repo,
+        comment_id: commentId,
+        body,
+    });
+}
+async function createCommentAndGetId(octokit, owner, repo, pullNumber, body) {
+    const created = await octokit.rest.issues.createComment({
+        owner,
+        repo,
+        issue_number: pullNumber,
+        body,
+    });
+    return created?.data?.id;
+}
+async function readMultiPartStickyIdsFromPrBody(octokit, owner, repo, pr, baseKind) {
+    const body = await getPrBody(octokit, owner, repo, pr);
+    const ids = new Map();
+    // Find all indexed markers for this base kind
+    // Break early once we encounter a gap (most comments are sequentially indexed)
+    let consecutiveGaps = 0;
+    for (let i = 0; i < MAX_MULTIPART_COMMENTS; i++) {
+        const m = body.match(multiPartIdRegex(baseKind, i));
+        if (m) {
+            ids.set(i, Number(m[1]));
+            consecutiveGaps = 0;
+        }
+        else {
+            consecutiveGaps++;
+            // Stop after finding 5 consecutive gaps (reasonable buffer for sparse indices)
+            if (consecutiveGaps >= 5)
+                break;
         }
-        // 2) Try to find existing comments by kind marker
-        try {
-            const all = await octokit.paginate(octokit.rest.issues.listComments, {
-                owner,
-                repo,
-                issue_number: pullNumber,
-                per_page: 100,
-            });
-            const marker = bodyMarker(kind);
-            const matches = all.filter((c) => typeof c.body === 'string' && c.body.includes(marker));
-            if (matches.length > 0) {
-                // Sort by created_at to identify the oldest comment
-                const sorted = matches.sort((a, b) => new Date(a.created_at).getTime() - new Date(b.created_at).getTime());
-                const primaryComment = sorted[0];
-                // Update the primary (oldest) comment
-                github_src_logger.info(`upsertStickyComment: found existing comment ID ${primaryComment.id} by marker for kind=${kind}, updating it and deleting ${sorted.length - 1} duplicates`);
-                await octokit.rest.issues.updateComment({
-                    owner,
-                    repo,
-                    comment_id: primaryComment.id,
-                    body: fullBody,
-                });
-                // Store its ID in PR body
-                await writeStickyIdToPrBody(octokit, owner, repo, pullNumber, kind, primaryComment.id);
-                // Delete all duplicate comments (from index 1 onwards)
-                for (let i = 1; i < sorted.length; i++) {
-                    github_src_logger.info(`upsertStickyComment: deleting duplicate comment ID ${sorted[i].id} for kind=${kind}`);
-                    try {
-                        await octokit.rest.issues.deleteComment({
-                            owner,
-                            repo,
-                            comment_id: sorted[i].id,
-                        });
-                    }
-                    catch (deleteErr) {
-                        // Log but continue deleting others
-                        github_src_logger.warn(`Failed to delete duplicate comment ${sorted[i].id} for ${kind}: ${deleteErr}`);
-                    }
+    }
+    return ids;
+}
+async function writeMultiPartStickyIdsToPrBody(octokit, owner, repo, pr, baseKind, ids) {
+    const oldBody = await getPrBody(octokit, owner, repo, pr);
+    let body = oldBody;
+    // Determine the highest index we need to clean up
+    // Add a small buffer to catch any stragglers from previous runs
+    const maxIndex = ids.size > 0 ? Math.max(...ids.keys()) + 5 : 5;
+    // Remove all old markers for this base kind (only up to needed range)
+    for (let i = 0; i <= maxIndex && i < MAX_MULTIPART_COMMENTS; i++) {
+        const rx = multiPartIdRegex(baseKind, i);
+        body = body.replace(rx, '');
+    }
+    // Add all new markers
+    let markers = '';
+    ids.forEach((id, index) => {
+        markers += `${multiPartIdMarker(baseKind, index, id)}\n`;
+    });
+    // Clean up extra newlines
+    markers = markers.trim();
+    let next = body.trim();
+    if (markers) {
+        next = next ? `${next}\n${markers}` : markers;
+    }
+    await updatePrBodyIfChanged(octokit, owner, repo, pr, next, oldBody);
+}
+/**
+ * Upsert sticky comments for one or more parts.
+ * Always uses indexed kinds (e.g., 'logs[0]', 'logs[1]', etc.) for consistency.
+ *
+ * Behavior:
+ * - Single part (bodies.length === 1): Uses indexed kind like 'logs[0]'
+ * - Multiple parts (bodies.length > 1): Uses indexed kinds 'logs[0]', 'logs[1]', etc.
+ * - Non-last parts include a note about continuation
+ * - Unused parts (from previous runs) are updated with a placeholder message
+ * - Never deletes comments
+ */
+async function upsertMultiPartStickyComments(octokit, params) {
+    const { owner, repo, pullNumber, baseKind, bodies } = params;
+    // Always use indexed kinds (e.g., 'logs[0]', 'logs[1]', etc.)
+    const lockKey = `${owner}/${repo}#${pullNumber}#${baseKind}[multi]`;
+    const totalParts = bodies.length;
+    await withLock(lockKey, async () => {
+        // Read existing comment IDs for this base kind
+        const existingIds = await readMultiPartStickyIdsFromPrBody(octokit, owner, repo, pullNumber, baseKind);
+        const newIds = new Map();
+        // Process each part of the new content
+        for (let partIndex = 0; partIndex < totalParts; partIndex++) {
+            const body = bodies[partIndex];
+            const isLastPart = partIndex === totalParts - 1;
+            // Build the full comment body with continuation notice for non-last parts
+            let fullBody = body;
+            if (!isLastPart) {
+                fullBody += `\n\n📝 **Note:** This is part ${partIndex + 1} of ${totalParts}. See next comment for continuation.`;
+            }
+            fullBody += `\n\n${multiPartBodyMarker(baseKind, partIndex)}`;
+            const existingId = existingIds.get(partIndex);
+            if (existingId) {
+                // Update existing comment
+                await updateComment(octokit, owner, repo, existingId, fullBody);
+                newIds.set(partIndex, existingId);
+            }
+            else {
+                // Create new comment
+                const newId = await createCommentAndGetId(octokit, owner, repo, pullNumber, fullBody);
+                if (newId !== undefined) {
+                    newIds.set(partIndex, newId);
                 }
-                return;
             }
         }
-        catch (err) {
-            // if paginate/listComments not available, we'll fall back to creating
-            github_src_logger.warn(`Failed to list comments for kind=${kind} on PR #${pullNumber}: ${err}`);
-        }
-        // 3) Create new comment and register
-        const created = await octokit.rest.issues.createComment({
-            owner,
-            repo,
-            issue_number: pullNumber,
-            body: fullBody,
-        });
-        const newId = created?.data?.id;
-        if (newId !== undefined) {
-            await writeStickyIdToPrBody(octokit, owner, repo, pullNumber, kind, newId);
+        // Handle old comments that are no longer needed (when new content is shorter)
+        // Update them with a placeholder message instead of deleting, but keep their IDs for potential reuse
+        for (const [oldIndex, oldId] of existingIds) {
+            if (!newIds.has(oldIndex)) {
+                const placeholderBody = `⚠️ This comment is no longer in use as the log output has been reduced.\n\n${multiPartBodyMarker(baseKind, oldIndex)}`;
+                await updateComment(octokit, owner, repo, oldId, placeholderBody);
+                newIds.set(oldIndex, oldId); // Preserve ID in PR body for reuse
+            }
         }
+        // Update PR body with all comment IDs
+        await writeMultiPartStickyIdsToPrBody(octokit, owner, repo, pullNumber, baseKind, newIds);
     });
 }
 
@@ -354263,12 +354294,12 @@ async function commentInPR(comment, pr_number, repo, owner = 'prefapp', stickyKi
         github_src_logger.info(`Commenting ${comment} in PR ${pr_number} of ${owner}/${repo}`);
         const octokit = await getOctokitForOrg(owner);
         if (stickyKind) {
-            await upsertStickyComment(octokit, {
+            await upsertMultiPartStickyComments(octokit, {
                 owner,
                 repo,
                 pullNumber: pr_number,
-                kind: stickyKind,
-                body: comment,
+                baseKind: stickyKind,
+                bodies: [comment],
             });
         }
         else {
@@ -354751,12 +354782,12 @@ class GithubCheckRun {
             return;
         const base = this.checkRunComment ?? '';
         const linkLine = base ? `${base}[here](${link})` : `[here](${link})`;
-        await upsertStickyComment(this.octokit, {
+        await upsertMultiPartStickyComments(this.octokit, {
             owner: this.owner,
             repo: this.repo,
             pullNumber: this.pullNumber,
-            kind: `check-run:${this.name}`,
-            body: linkLine,
+            baseKind: `check-run:${this.name}`,
+            bodies: [linkLine],
         });
     }
 }
@@ -354854,6 +354885,7 @@ async function encryptRepoSecret(owner, repo, section, plaintextValue) {
 
 
 
+
 /* harmony default export */ const github_0 = ({
     org: organization,
     repo: repository,
@@ -354870,6 +354902,7 @@ async function encryptRepoSecret(owner, repo, section, plaintextValue) {
     feedback: {
         createCheckRun: createCheckRun,
         CheckRun: CheckRun,
+        upsertMultiPartStickyComments: upsertMultiPartStickyComments,
     },
     encryption: {
         encryptRepoSecret: encryptRepoSecret,
@@ -356774,6 +356807,10 @@ class SyncerInitializer extends InitializerPatches {
             const provider = helperCTX(ctx).provider;
             return claim.providers[provider].sync || {};
         }
+        function policyInfo(ctx) {
+            const provider = helperCTX(ctx).provider;
+            return claim.providers[provider].policy;
+        }
         return [
             {
                 validate(cr) {
@@ -356804,21 +356841,23 @@ class SyncerInitializer extends InitializerPatches {
                     }
                 },
                 apply(cr) {
+                    cr.metadata.annotations = cr.metadata.annotations || {};
+                    // Apply general policy annotation
+                    if (policyInfo(this)) {
+                        cr.metadata.annotations['firestartr.dev/policy'] =
+                            policyInfo(this);
+                    }
                     if (syncInfo(this).enabled) {
-                        cr.metadata.annotations = cr.metadata.annotations || {};
                         cr.metadata.annotations['firestartr.dev/sync-enabled'] = 'true';
                         if (syncInfo(this).period) {
-                            cr.metadata.annotations = cr.metadata.annotations || {};
                             cr.metadata.annotations['firestartr.dev/sync-period'] =
                                 syncInfo(this).period;
                         }
                         if (syncInfo(this).policy) {
-                            cr.metadata.annotations = cr.metadata.annotations || {};
                             cr.metadata.annotations['firestartr.dev/sync-policy'] =
                                 syncInfo(this).policy;
                         }
                         if (syncInfo(this).schedule) {
-                            cr.metadata.annotations = cr.metadata.annotations || {};
                             cr.metadata.annotations[SYNC_SCHED_ANNOTATION] =
                                 syncInfo(this).schedule;
                             cr.metadata.annotations[SYNC_SCHED_TIMEZONE_ANNOTATION] =
@@ -357539,6 +357578,69 @@ const external_node_child_process_namespaceObject = __WEBPACK_EXTERNAL_createReq
             },
             additionalProperties: false,
         },
+        PolicyType: {
+            $id: 'firestartr.dev://common/PolicyType',
+            type: 'string',
+            description: 'Policy for resource management',
+            enum: [
+                'apply',
+                'create-only',
+                'create-update-only',
+                'full-control',
+                'observe',
+                'observe-only',
+            ],
+        },
+        SyncConfig: {
+            $id: 'firestartr.dev://common/SyncConfig',
+            type: 'object',
+            description: 'Sync configuration for resources',
+            properties: {
+                enabled: {
+                    type: 'boolean',
+                    description: 'Enable periodic sync operations',
+                },
+                period: {
+                    type: 'string',
+                    pattern: '^[0-9]+[smhd]$',
+                    description: 'Sync period (e.g., 1h, 30m, 5s). Must be enabled without schedule.',
+                },
+                schedule: {
+                    type: 'string',
+                    description: 'Cron schedule for sync operations. Must be enabled without period.',
+                },
+                schedule_timezone: {
+                    type: 'string',
+                    description: 'Timezone for cron schedule (e.g., UTC, America/New_York)',
+                },
+                policy: {
+                    type: 'string',
+                    description: 'Policy for sync operations (apply or observe)',
+                },
+            },
+            additionalProperties: false,
+            required: ['enabled'],
+            oneOf: [
+                {
+                    required: ['period'],
+                },
+                {
+                    required: ['schedule'],
+                },
+                {
+                    not: {
+                        anyOf: [
+                            {
+                                required: ['period'],
+                            },
+                            {
+                                required: ['schedule'],
+                            },
+                        ],
+                    },
+                },
+            ],
+        },
     },
 });
 
@@ -357899,6 +358001,9 @@ const external_node_child_process_namespaceObject = __WEBPACK_EXTERNAL_createReq
                 {
                     type: 'object',
                     properties: {
+                        policy: {
+                            $ref: 'firestartr.dev://common/PolicyType',
+                        },
                         privacy: {
                             type: 'string',
                             enum: ['closed', 'secret'],
@@ -357909,6 +358014,9 @@ const external_node_child_process_namespaceObject = __WEBPACK_EXTERNAL_createReq
                         org: {
                             type: 'string',
                         },
+                        sync: {
+                            $ref: 'firestartr.dev://common/SyncConfig',
+                        },
                     },
                     required: ['org', 'privacy'],
                 },
@@ -357934,6 +358042,9 @@ const external_node_child_process_namespaceObject = __WEBPACK_EXTERNAL_createReq
                 {
                     type: 'object',
                     properties: {
+                        policy: {
+                            $ref: 'firestartr.dev://common/PolicyType',
+                        },
                         role: {
                             type: 'string',
                             enum: ['admin', 'member'],
@@ -357941,6 +358052,9 @@ const external_node_child_process_namespaceObject = __WEBPACK_EXTERNAL_createReq
                         org: {
                             type: 'string',
                         },
+                        sync: {
+                            $ref: 'firestartr.dev://common/SyncConfig',
+                        },
                     },
                     required: ['org', 'role'],
                 },
@@ -357965,6 +358079,9 @@ const external_node_child_process_namespaceObject = __WEBPACK_EXTERNAL_createReq
                 {
                     type: 'object',
                     properties: {
+                        policy: {
+                            $ref: 'firestartr.dev://common/PolicyType',
+                        },
                         org: {
                             type: 'string',
                             description: 'The github organization name',
@@ -357973,6 +358090,9 @@ const external_node_child_process_namespaceObject = __WEBPACK_EXTERNAL_createReq
                             type: 'string',
                             enum: ['private', 'public', 'internal'],
                         },
+                        sync: {
+                            $ref: 'firestartr.dev://common/SyncConfig',
+                        },
                         features: {
                             type: 'array',
                             items: {
@@ -358008,6 +358128,9 @@ const external_node_child_process_namespaceObject = __WEBPACK_EXTERNAL_createReq
                 {
                     type: 'object',
                     properties: {
+                        policy: {
+                            $ref: 'firestartr.dev://common/PolicyType',
+                        },
                         orgName: {
                             type: 'string',
                             description: 'Organization name on GitHub',
@@ -358041,6 +358164,9 @@ const external_node_child_process_namespaceObject = __WEBPACK_EXTERNAL_createReq
                             },
                             required: ['url', 'contentType', 'events', 'secretRef'],
                         },
+                        sync: {
+                            $ref: 'firestartr.dev://common/SyncConfig',
+                        },
                     },
                     required: ['orgName', 'webhook'],
                 },
@@ -358212,15 +358338,7 @@ const GithubSchemas = [
                     type: 'object',
                     properties: {
                         policy: {
-                            type: 'string',
-                            enum: [
-                                'apply',
-                                'create-only',
-                                'create-update-only',
-                                'full-control',
-                                'observe',
-                                'observe-only',
-                            ],
+                            $ref: 'firestartr.dev://common/PolicyType',
                         },
                         name: {
                             type: 'string',
@@ -358230,47 +358348,7 @@ const GithubSchemas = [
                             enum: ['remote', 'inline', 'Remote', 'Inline'],
                         },
                         sync: {
-                            type: 'object',
-                            properties: {
-                                enabled: {
-                                    type: 'boolean',
-                                },
-                                period: {
-                                    type: 'string',
-                                    pattern: '^[0-9]+[smhd]$',
-                                },
-                                schedule: {
-                                    type: 'string',
-                                },
-                                schedule_timezone: {
-                                    type: 'string',
-                                },
-                                policy: {
-                                    type: 'string',
-                                },
-                            },
-                            additionalProperties: false,
-                            required: ['enabled'],
-                            oneOf: [
-                                {
-                                    required: ['period'],
-                                },
-                                {
-                                    required: ['schedule'],
-                                },
-                                {
-                                    not: {
-                                        anyOf: [
-                                            {
-                                                required: ['period'],
-                                            },
-                                            {
-                                                required: ['schedule'],
-                                            },
-                                        ],
-                                    },
-                                },
-                            ],
+                            $ref: 'firestartr.dev://common/SyncConfig',
                         },
                         valuesSchema: {
                             type: 'string',
@@ -370377,10 +370455,15 @@ class Resource {
         this.set('operation', operation);
         this.set('deps', deps);
     }
-    async run() {
+    async run(options) {
         await this.preprocess();
         await this.synth();
-        await this.runTerraform();
+        if (options?.planOnly) {
+            await this.runTerraformPlanOnly();
+        }
+        else {
+            await this.runTerraform();
+        }
         await this.postprocess();
         if (this.logStream) {
             this.logStream.end();
@@ -370405,6 +370488,13 @@ class Resource {
     log(msg) {
         this.logFn(msg);
     }
+    async runTerraformPlanOnly() {
+        await this.onTFStreaming();
+        let output = '';
+        output += await terraformInit(this.get('main_artifact'), this.logStream);
+        output += await terraformPlan(this.get('main_artifact'), this.logStream);
+        this.set('output', output);
+    }
     async runTerraform() {
         await this.onTFStreaming();
         let output = '';
@@ -370792,7 +370882,7 @@ async function runProvisioner(data, opts) {
     if ('logStreamCallbacksTF' in opts) {
         resource.setTFStreamLogs(opts['logStreamCallbacksTF']);
     }
-    await resource.run();
+    await resource.run({ planOnly: opts.planOnly });
     return resource;
 }
 function createInstanceOf(entity, op, deps) {
@@ -370892,25 +370982,33 @@ async function tryPublishDestroy(item, destroyOutput) {
             return;
         }
         const dividedOutput = github_0.pulls.divideCommentIntoChunks(destroyOutput, 250);
-        let currentCommentNo = 1;
-        for (const commentContent of dividedOutput) {
-            const comment = `<h1>
+        const commentBodies = dividedOutput.map((commentContent, index) => {
+            const isMultiPart = dividedOutput.length > 1;
+            const partIndicator = isMultiPart ? ` (Part ${index + 1})` : '';
+            return `<h1>
 <img  width="25"  src="https://raw.githubusercontent.com/firestartr-pro/docs/refs/heads/main/logos/square-nobg.png"> Destroy Finished
 </h1>
 <p><b>TFWorkspace: </b>${item.metadata.name}</p>
 
 <details id=github>
-<summary>DESTROY LOGS ${dividedOutput.length > 1 ? '(Part ' + currentCommentNo + ')' : ''}</summary>
+<summary>DESTROY LOGS${partIndicator}</summary>
 
 \`\`\`shell
 ${commentContent}
 \`\`\`
 </details>`;
-            operator_src_logger.debug(`The user feedback for item '${item.kind}/${item.metadata.name}' is being published as a comment on pull request '${lastPr.number}' for repository '${repo}' in organization '${org}'.`);
-            await github_0.pulls.commentInPR(comment, lastPr.number, repo, org, 'tfworkspace:destroy');
-            operator_src_logger.debug(`The user feedback for the '${item.kind}/${item.metadata.name}' destroy operation is being published as a comment on pull request '${lastPr.number}'.`);
-            currentCommentNo += 1;
-        }
+        });
+        operator_src_logger.debug(`The user feedback for item '${item.kind}/${item.metadata.name}' is being published as a comment on pull request '${lastPr.number}' for repository '${repo}' in organization '${org}'.`);
+        // Get octokit instance for the org to use with upsertMultiPartStickyComments
+        const octokit = await github_0.auth.getOctokitForOrg(org);
+        await github_0.feedback.upsertMultiPartStickyComments(octokit, {
+            owner: org,
+            repo,
+            pullNumber: lastPr.number,
+            baseKind: 'tfworkspace:destroy',
+            bodies: commentBodies,
+        });
+        operator_src_logger.debug(`The user feedback for the '${item.kind}/${item.metadata.name}' destroy operation has been published as a comment on pull request '${lastPr.number}'.`);
     }
     catch (e) {
         operator_src_logger.error(`An error occurred while publishing user feedback for item '${item.kind}/${item.metadata.name}': '${e}'.`);
@@ -370919,23 +371017,31 @@ ${commentContent}
 async function publishApply(item, applyOutput, kind) {
     const { prNumber, repo, org } = extractPrInfo(item);
     const dividedOutput = github_0.pulls.divideCommentIntoChunks(applyOutput, 250);
-    let currentCommentNo = 1;
-    for (const commentContent of dividedOutput) {
-        const comment = `<h1>
+    const commentBodies = dividedOutput.map((commentContent, index) => {
+        const isMultiPart = dividedOutput.length > 1;
+        const partIndicator = isMultiPart ? ` (Part ${index + 1})` : '';
+        return `<h1>
 <img  width="25"  src="https://raw.githubusercontent.com/firestartr-pro/docs/refs/heads/main/logos/square-nobg.png"> Apply Finished
 </h1>
 <p><b>${kind}: </b>${item.metadata.name}</p>
 
 <details id=github>
-<summary>APPLY LOGS ${dividedOutput.length > 1 ? '(Part ' + currentCommentNo + ')' : ''}</summary>
+<summary>APPLY LOGS${partIndicator}</summary>
 
 \`\`\`shell
 ${commentContent}
 \`\`\`
 </details>`;
-        await github_0.pulls.commentInPR(comment, prNumber, repo, org, 'apply');
-        currentCommentNo += 1;
-    }
+    });
+    // Get octokit instance for the org to use with upsertMultiPartStickyComments
+    const octokit = await github_0.auth.getOctokitForOrg(org);
+    await github_0.feedback.upsertMultiPartStickyComments(octokit, {
+        owner: org,
+        repo,
+        pullNumber: prNumber,
+        baseKind: `apply:${kind}`,
+        bodies: commentBodies,
+    });
 }
 function tryCreateErrorSummary(title, errorMsg) {
     try {
@@ -370993,23 +371099,31 @@ ${message}
 async function publishPlan(item, planOutput, prNumber, repo, org) {
     try {
         const dividedOutput = github_0.pulls.divideCommentIntoChunks(planOutput, 250);
-        let currentCommentNo = 1;
-        for (const commentContent of dividedOutput) {
-            const comment = `<h1>
+        const commentBodies = dividedOutput.map((commentContent, index) => {
+            const isMultiPart = dividedOutput.length > 1;
+            const partIndicator = isMultiPart ? ` (Part ${index + 1})` : '';
+            return `<h1>
 <img  width="25"  src="https://raw.githubusercontent.com/firestartr-pro/docs/refs/heads/main/logos/square-nobg.png"> Plan Finished
 </h1>
 <p><b>TFWorkspace: </b>${item.metadata.name}</p>
 
 <details id=github>
-<summary>PLAN LOGS ${dividedOutput.length > 1 ? '(Part ' + currentCommentNo + ')' : ''}</summary>
+<summary>PLAN LOGS${partIndicator}</summary>
 
 \`\`\`shell
 ${commentContent}
 \`\`\`
 </details>`;
-            await github_0.pulls.commentInPR(comment, prNumber, repo, org, 'tfworkspace:plan');
-            currentCommentNo += 1;
-        }
+        });
+        // Get octokit instance for the org to use with upsertMultiPartStickyComments
+        const octokit = await github_0.auth.getOctokitForOrg(org);
+        await github_0.feedback.upsertMultiPartStickyComments(octokit, {
+            owner: org,
+            repo,
+            pullNumber: prNumber,
+            baseKind: 'tfworkspace:plan',
+            bodies: commentBodies,
+        });
     }
     catch (e) {
         console.error(e);
@@ -371050,6 +371164,51 @@ function helperCreateCheckRunName(cmd, item) {
     return `${item.kind} - ${cmd}`;
 }
 
+;// CONCATENATED MODULE: ../operator/src/utils/index.ts
+const secretRegex = /\$\{\{ secrets\.(.*?) \}\}/g;
+function replaceConfigSecrets(config, secrets) {
+    for (const key in config) {
+        if (typeof config[key] === 'object' && config[key] !== null) {
+            // If the property is an object, call this function recursively
+            replaceConfigSecrets(config[key], secrets);
+        }
+        else if (typeof config[key] === 'string') {
+            // If the property is a string and its value is equal to secrets.something,
+            // replace the value with the value of the 'something' key in the secrets object
+            config[key] = config[key].replace(secretRegex, (_, group1) => {
+                if (!secrets[group1]) {
+                    throw new Error(`Secret ${group1} not found in secrets`);
+                }
+                return secrets[group1];
+            });
+        }
+    }
+    return config;
+}
+function replaceInlineSecrets(inline, secrets) {
+    if (typeof inline !== 'string' || !inline)
+        return inline;
+    let result = inline;
+    result = result.replace(secretRegex, (_, group1) => {
+        if (!secrets[group1]) {
+            throw new Error(`Secret ${group1} not found in secrets`);
+        }
+        return secrets[group1];
+    });
+    return result;
+}
+/**
+ * Retrieves a policy annotation value from a custom resource
+ * @param item - The CR to get the policy from
+ * @param annotation - The annotation key to retrieve
+ * @returns The policy value, or undefined if not set
+ */
+function getPolicy(item, annotation) {
+    const policy = item.metadata.annotations && item.metadata.annotations[annotation];
+    if (policy)
+        return policy;
+}
+
 ;// CONCATENATED MODULE: ../operator/cdktf.ts
 
 
@@ -371059,9 +371218,17 @@ function helperCreateCheckRunName(cmd, item) {
 
 
 
+
+const cdktf_LAST_STATE_PR_ANNOTATION = 'firestartr.dev/last-state-pr';
 function processOperation(item, op, handler) {
     operator_src_logger.info(`Processing operation ${op} on ${item.kind}/${item.metadata?.name}`);
     try {
+        const policy = getPolicy(item, 'firestartr.dev/policy');
+        // If general policy is observe/observe-only, route to observe mode instead of apply
+        if (!policy || policy === 'observe' || policy === 'observe-only') {
+            operator_src_logger.info(`Policy is '${policy || 'not set (default)'}', routing to observe mode`);
+            return cdktf_observe(item, op, handler);
+        }
         switch (op) {
             case OperationType.UPDATED:
                 return updated(item, op, handler);
@@ -371086,6 +371253,11 @@ function processOperation(item, op, handler) {
         throw e;
     }
 }
+async function* cdktf_observe(item, op, handler) {
+    for await (const transition of doPlan(item, op, handler)) {
+        yield transition;
+    }
+}
 async function* created(item, op, handler) {
     for await (const transition of doApply(item, op, handler)) {
         yield transition;
@@ -371121,8 +371293,18 @@ async function* sync(item, op, handler) {
         status: 'False',
         message: 'Synth CDKTF',
     };
-    for await (const transition of doApply(item, op, handler)) {
-        yield transition;
+    const syncPolicy = getPolicy(item, 'firestartr.dev/sync-policy');
+    if (syncPolicy === 'apply') {
+        operator_src_logger.info(`SYNC OPERATION: applying item ${item.metadata.name} with sync-policy=${syncPolicy}`);
+        for await (const transition of doApply(item, op, handler)) {
+            yield transition;
+        }
+    }
+    else {
+        operator_src_logger.info(`SYNC OPERATION: planning item ${item.metadata.name} with sync-policy=${syncPolicy || 'default (observe)'}`);
+        for await (const transition of doPlan(item, op, handler)) {
+            yield transition;
+        }
     }
     yield {
         item,
@@ -371161,15 +371343,14 @@ async function* markedToDeletion(item, op, handler) {
             message: 'Destroying process started',
         };
         const deps = await handler.resolveReferences();
-        const annotation = 'firestartr.dev/last-state-pr';
-        const statePr = item?.metadata?.annotations?.[annotation];
+        const statePr = item?.metadata?.annotations?.[cdktf_LAST_STATE_PR_ANNOTATION];
         const hasStatePr = typeof statePr === 'string' && statePr.trim().length > 0;
         if (!hasStatePr) {
             operator_src_logger.warn(`CR ${item?.kind ?? 'UnknownKind'}/${item?.metadata?.name ?? 'unknown'} ` +
-                `has no "${annotation}" annotation; skipping GitHub Check Runs (synth, terraform apply).`);
+                `has no "${cdktf_LAST_STATE_PR_ANNOTATION}" annotation; skipping GitHub Check Runs (synth, terraform apply).`);
         }
         else {
-            operator_src_logger.debug(`CR ${item.kind}/${item.metadata.name} uses "${annotation}" = ${statePr}`);
+            operator_src_logger.debug(`CR ${item.kind}/${item.metadata.name} uses "${cdktf_LAST_STATE_PR_ANNOTATION}" = ${statePr}`);
         }
         const destroyOutput = await provisioner.runProvisioner({
             mainCr: item,
@@ -371204,7 +371385,7 @@ async function* markedToDeletion(item, op, handler) {
         };
         await handler.finalize(handler.pluralKind, item.metadata.namespace, item, 'firestartr.dev/finalizer');
         await handler.writeTerraformOutputInTfResult(item, output);
-        if (item.metadata.annotations['firestartr.dev/last-state-pr'] || false) {
+        if (item.metadata.annotations[cdktf_LAST_STATE_PR_ANNOTATION] || false) {
             await addDestroyCommitStatus(item, 'success', 'Destroy operation completed', `Terraform Destroy ${item.metadata.name}`);
         }
         void handler.success();
@@ -371285,15 +371466,14 @@ async function* doApply(item, op, handler) {
         }
         const deps = await handler.resolveReferences();
         operator_src_logger.info(`Item ${item.metadata.name} has the following dependencies: ${deps}`);
-        const annotation = 'firestartr.dev/last-state-pr';
-        const statePr = item?.metadata?.annotations?.[annotation];
+        const statePr = item?.metadata?.annotations?.[cdktf_LAST_STATE_PR_ANNOTATION];
         const hasStatePr = typeof statePr === 'string' && statePr.trim().length > 0;
         if (!hasStatePr) {
             operator_src_logger.warn(`CR ${item?.kind ?? 'UnknownKind'}/${item?.metadata?.name ?? 'unknown'} ` +
-                `has no "${annotation}" annotation; skipping GitHub Check Runs (synth, terraform apply).`);
+                `has no "${cdktf_LAST_STATE_PR_ANNOTATION}" annotation; skipping GitHub Check Runs (synth, terraform apply).`);
         }
         else {
-            operator_src_logger.debug(`CR ${item.kind}/${item.metadata.name} uses "${annotation}" = ${statePr}`);
+            operator_src_logger.debug(`CR ${item.kind}/${item.metadata.name} uses "${cdktf_LAST_STATE_PR_ANNOTATION}" = ${statePr}`);
         }
         const applyOutput = await provisioner.runProvisioner({
             mainCr: item,
@@ -371389,6 +371569,219 @@ async function* doApply(item, op, handler) {
         }
     }
 }
+async function* doPlan(item, op, handler) {
+    let checkRunCtl;
+    try {
+        cleanTerraformState();
+        yield {
+            item,
+            reason: op,
+            type: 'PLANNING',
+            status: 'True',
+            message: 'Planning process started',
+        };
+        const deps = await handler.resolveReferences();
+        const statePr = item?.metadata?.annotations?.[cdktf_LAST_STATE_PR_ANNOTATION];
+        const hasStatePr = typeof statePr === 'string' && statePr.trim().length > 0;
+        if (!hasStatePr) {
+            operator_src_logger.warn(`CR ${item?.kind ?? 'UnknownKind'}/${item?.metadata?.name ?? 'unknown'} ` +
+                `has no "${cdktf_LAST_STATE_PR_ANNOTATION}" annotation; skipping GitHub Check Runs for plan.`);
+        }
+        else {
+            operator_src_logger.debug(`CR ${item.kind}/${item.metadata.name} uses "${cdktf_LAST_STATE_PR_ANNOTATION}" = ${statePr}`);
+            await addPlanStatusCheck(statePr, 'CDKTF plan in progress...');
+        }
+        // Run provisioner in plan-only mode
+        const planResult = await provisioner.runProvisioner({ mainCr: item, deps }, {
+            planOnly: true,
+            delete: 'deletionTimestamp' in item.metadata,
+            ...(hasStatePr
+                ? {
+                    logStreamCallbacksCDKTF: {
+                        prepare: async () => {
+                            checkRunCtl = await GHCheckRun('synth', item);
+                            return checkRunCtl;
+                        },
+                    },
+                    logStreamCallbacksTF: {
+                        prepare: async () => {
+                            checkRunCtl = await GHCheckRun('plan', item);
+                            return checkRunCtl;
+                        },
+                    },
+                }
+                : {}),
+        });
+        const planOutput = planResult?.output || '';
+        // Parse terraform plan output to detect changes
+        // Handles multiple Terraform output formats and versions
+        const hasChanges = detectPlanChanges(planOutput);
+        if (hasChanges) {
+            yield {
+                item,
+                reason: op,
+                type: 'OUT_OF_SYNC',
+                status: 'True',
+                message: 'Plan has changes',
+            };
+            yield {
+                item,
+                reason: op,
+                type: 'PROVISIONED',
+                status: 'False',
+                message: 'Plan has changes',
+            };
+        }
+        else {
+            yield {
+                item,
+                reason: op,
+                type: 'OUT_OF_SYNC',
+                status: 'False',
+                message: 'Plan has no changes',
+            };
+            yield {
+                item,
+                reason: op,
+                type: 'PROVISIONED',
+                status: 'True',
+                message: 'Plan has no changes',
+            };
+        }
+        // Store plan details for later reference
+        yield {
+            item,
+            reason: op,
+            type: 'LAST_PLAN_DETAILS',
+            status: 'Unknown',
+            message: planOutput,
+        };
+        yield {
+            item,
+            reason: op,
+            type: 'PLANNING',
+            status: 'False',
+            message: 'Planning process finished',
+        };
+        if (hasStatePr) {
+            await addPlanStatusCheck(statePr, hasChanges ? 'Plan has changes' : 'Plan has no changes', 'completed');
+        }
+    }
+    catch (e) {
+        operator_src_logger.error(`CDKTF plan failed: ${e}`);
+        if (checkRunCtl) {
+            checkRunCtl.fnOnError(e);
+        }
+        yield {
+            item,
+            reason: op,
+            type: 'ERROR',
+            status: 'True',
+            message: e.toString(),
+        };
+        yield {
+            item,
+            reason: op,
+            type: 'PLANNING',
+            status: 'False',
+            message: e.toString(),
+        };
+        yield {
+            item,
+            reason: op,
+            type: 'PROVISIONED',
+            status: 'False',
+            message: e.toString(),
+        };
+        const statePr = item?.metadata?.annotations?.[cdktf_LAST_STATE_PR_ANNOTATION];
+        if (statePr) {
+            const summaryText = tryCreateErrorSummary('CDKTF Plan failed', e);
+            await addPlanStatusCheck(statePr, summaryText, 'completed', true);
+        }
+        await handler.writeTerraformOutputInTfResult(item, e);
+        void handler.error();
+    }
+}
+/**
+ * Detects if a Terraform plan output contains changes
+ * Handles multiple Terraform versions and output formats
+ * @param planOutput - The text output from terraform plan
+ * @returns true if changes are detected, false otherwise
+ */
+function detectPlanChanges(planOutput) {
+    if (!planOutput || planOutput.trim().length === 0) {
+        return false;
+    }
+    // Normalize the output for consistent matching
+    const normalized = planOutput.toLowerCase();
+    // Pattern 1: "Plan: X to add, Y to change, Z to destroy"
+    // Matches: "Plan: 1 to add, 0 to change, 0 to destroy"
+    const planPattern = /plan:\s*(\d+)\s+to\s+add,\s*(\d+)\s+to\s+change,\s*(\d+)\s+to\s+destroy/i;
+    const planMatch = planOutput.match(planPattern);
+    if (planMatch) {
+        const add = Number(planMatch[1]);
+        const change = Number(planMatch[2]);
+        const destroy = Number(planMatch[3]);
+        if (add > 0 || change > 0 || destroy > 0) {
+            return true;
+        }
+        // Explicitly found "Plan:" with 0/0/0 - no changes
+        return false;
+    }
+    // Pattern 2: Individual change indicators
+    // Handles variations like "1 to add", "2 to change", "3 to destroy"
+    const hasAdditions = /\d+\s+to\s+add/i.test(planOutput);
+    const hasChanges = /\d+\s+to\s+change/i.test(planOutput);
+    const hasDestructions = /\d+\s+to\s+destroy/i.test(planOutput);
+    const hasImports = /\d+\s+to\s+import/i.test(planOutput);
+    if (hasAdditions || hasChanges || hasDestructions || hasImports) {
+        return true;
+    }
+    // Pattern 3: Resource-level change indicators
+    // Matches: "# resource will be created", "# resource will be updated", etc.
+    const resourceChangePatterns = [
+        /will\s+be\s+(created|destroyed|updated|replaced)/i,
+        /must\s+be\s+(created|destroyed|updated|replaced)/i,
+        /#.*\s+(create|destroy|update|replace)/i,
+    ];
+    for (const pattern of resourceChangePatterns) {
+        if (pattern.test(planOutput)) {
+            return true;
+        }
+    }
+    // Pattern 4: Action symbols in plan output
+    // Terraform uses symbols like +, -, ~, -/+ to indicate changes
+    const actionSymbols = [
+        /^\s*[+]\s+/m,
+        /^\s*[-]\s+/m,
+        /^\s*[~]\s+/m,
+        /^\s*[-][/][+]\s+/m, // Replace
+    ];
+    for (const pattern of actionSymbols) {
+        if (pattern.test(planOutput)) {
+            return true;
+        }
+    }
+    // Pattern 5: No changes messages (inverse check)
+    const noChangesPatterns = [
+        /no\s+changes/i,
+        /infrastructure\s+is\s+up[-\s]to[-\s]date/i,
+        /your\s+infrastructure\s+matches\s+the\s+configuration/i,
+        /0\s+to\s+add,\s*0\s+to\s+change,\s*0\s+to\s+destroy/i,
+    ];
+    for (const pattern of noChangesPatterns) {
+        if (pattern.test(planOutput)) {
+            return false;
+        }
+    }
+    // If we find "Plan:" keyword but couldn't parse it, log a warning and assume no changes
+    if (normalized.includes('plan:')) {
+        operator_src_logger.warn('Found "Plan:" in output but could not parse change counts. Assuming no changes.');
+        return false;
+    }
+    // Default: assume no changes if we can't detect any
+    return false;
+}
 function cleanTerraformState() {
     external_fs_.rmSync('/library/packages/provisioner/cdktf.out', {
         recursive: true,
@@ -372388,40 +372781,6 @@ function tf_checkrun_helperCreateCheckRunName(cmd) {
     return `TFWorkspace - ${cmd}`;
 }
 
-;// CONCATENATED MODULE: ../operator/src/utils/index.ts
-const secretRegex = /\$\{\{ secrets\.(.*?) \}\}/g;
-function replaceConfigSecrets(config, secrets) {
-    for (const key in config) {
-        if (typeof config[key] === 'object' && config[key] !== null) {
-            // If the property is an object, call this function recursively
-            replaceConfigSecrets(config[key], secrets);
-        }
-        else if (typeof config[key] === 'string') {
-            // If the property is a string and its value is equal to secrets.something,
-            // replace the value with the value of the 'something' key in the secrets object
-            config[key] = config[key].replace(secretRegex, (_, group1) => {
-                if (!secrets[group1]) {
-                    throw new Error(`Secret ${group1} not found in secrets`);
-                }
-                return secrets[group1];
-            });
-        }
-    }
-    return config;
-}
-function replaceInlineSecrets(inline, secrets) {
-    if (typeof inline !== 'string' || !inline)
-        return inline;
-    let result = inline;
-    result = result.replace(secretRegex, (_, group1) => {
-        if (!secrets[group1]) {
-            throw new Error(`Secret ${group1} not found in secrets`);
-        }
-        return secrets[group1];
-    });
-    return result;
-}
-
 ;// CONCATENATED MODULE: ../operator/src/tfworkspaces/process-operation.ts
 
 
@@ -372612,11 +372971,6 @@ async function* process_operation_renamed(item, op, handler) {
         yield transition;
     }
 }
-function getPolicy(item, annotation) {
-    const policy = item.metadata.annotations && item.metadata.annotations[annotation];
-    if (policy)
-        return policy;
-}
 async function* process_operation_updated(item, op, handler) {
     for await (const transition of process_operation_doApply(item, op, handler)) {
         yield transition;
@@ -373260,7 +373614,7 @@ const processOperationPlan_TF_PROJECTS_PATH = '/tmp/tfworkspaces';
 function processOperationPlan(item, op, handler) {
     try {
         processOperationPlan_clearLocalTfProjects();
-        const policy = processOperationPlan_getPolicy(item);
+        const policy = getPolicy(item, 'firestartr.dev/policy');
         if (policy === 'observe' || policy === 'apply') {
             return processOperationPlan_plan(item, op, handler);
         }
@@ -373707,12 +374061,6 @@ function processOperationPlan_getErrorOutputMessage(cr, key, ref) {
         throw new Error(`❌ Source ${cr.spec.source} not supported`);
     }
 }
-function processOperationPlan_getPolicy(item) {
-    const policy = item.metadata.annotations &&
-        item.metadata.annotations['firestartr.dev/policy'];
-    if (policy)
-        return policy;
-}
 
 ;// CONCATENATED MODULE: ../operator/src/ctx.ts
 class Ctx {