@firestartr/cli 2.8.0-snapshot-variant-cloning-test-1 → 2.8.0-snapshot-variant-cloning-1

package/build/index.js

@@ -320729,10 +320729,6 @@ const GithubSchemas = [
             description: 'Override fields for a variant of a TFWorkspaceClaim',
             type: 'object',
             properties: {
-                name: {
-                    type: 'string',
-                    description: 'override the terraform provider name',
-                },
                 values: {
                     type: 'object',
                     additionalProperties: true,
@@ -320799,7 +320795,8 @@ const GithubSchemas = [
             properties: {
                 name: {
                     type: 'string',
-                    description: 'name of the variant — used as claim name and CR name base',
+                    maxLength: 10,
+                    description: 'shorthand suffix — composed with main tf name to form the final CR name',
                 },
                 overrides: {
                     $ref: 'firestartr.dev://terraform/TerraformProviderVariantOverride',
@@ -321333,20 +321330,19 @@ async function loadClaim(claimRef, org, defaults = loadClaimDefaults(), patchCla
                         throw new Error(`Variant '${variant.name}' in claim ${claimRef} cannot override '${field}'`);
                     }
                 }
+                const composedName = claim.providers.terraform.name + '-' + variant.name;
                 const variantClaim = lodash_default().cloneDeep(claim);
-                variantClaim.name = variant.name;
+                variantClaim.name = composedName;
                 variantClaim.providers.terraform = lodash_default().merge({}, claim.providers.terraform, variant.overrides);
-                if (!variant.overrides.name) {
-                    variantClaim.providers.terraform.name = variant.name;
-                }
+                variantClaim.providers.terraform.name = composedName;
                 if (!variantClaim.annotations) {
                     variantClaim.annotations = {};
                 }
                 variantClaim.annotations['firestartr.dev/variant-of'] =
                     claim.providers.terraform.name;
-                const variantRef = `TFWorkspaceClaim-${variant.name}`;
+                const variantRef = `TFWorkspaceClaim-${composedName}`;
                 if (result[variantRef]) {
-                    throw new Error(`Variant name '${variant.name}' from claim '${claimRef}' conflicts with existing claim '${variantRef}'`);
+                    throw new Error(`Variant name '${variant.name}' (composed: '${composedName}') from claim '${claimRef}' conflicts with existing claim '${variantRef}'`);
                 }
                 logger.info(`Creating synthetic variant claim ${variantRef}`);
                 result[variantRef] = {};
@@ -331003,7 +330999,19 @@ var OperationType;
     OperationType["MARKED_TO_DELETION"] = "MARKED_TO_DELETION";
     OperationType["NOTHING"] = "NOTHING";
     OperationType["RETRY"] = "RETRY";
+    OperationType["RETRY_SYNC"] = "RETRY_SYNC";
 })(OperationType || (OperationType = {}));
+function retryOpForReason(reason) {
+    if (!reason)
+        return OperationType.RETRY;
+    const base = reason.startsWith('RETRY_') ? reason.slice(6) : reason;
+    switch (base) {
+        case 'SYNC':
+            return OperationType.RETRY_SYNC;
+        default:
+            return OperationType.RETRY;
+    }
+}
 var WorkStatus;
 (function (WorkStatus) {
     WorkStatus["PENDING"] = "PENDING";
@@ -331020,6 +331028,7 @@ const TIMEOUTS = {
     UPDATED: DAY_SECONDS,
     CREATED: DAY_SECONDS,
     RETRY: 120 * 60,
+    RETRY_SYNC: 120 * 60,
     MARKED_TO_DELETION: DAY_SECONDS,
     SYNC: DAY_SECONDS,
     NOTHING: 10,
@@ -331257,13 +331266,13 @@ async function ctl_getItemByItemPath(itemPath, apiGroup = catalog_common/* defau
             const r = await fetchItemByItemPathResponse(itemPath, apiGroup, apiVersion);
             if (!r.ok) {
                 const err = new Error(`Error on getItemByItemPath: ${itemPath}: ${r.statusText}`);
-                operator_src_logger.error(`Error on getItemByItemPath: ${itemPath}: ${r.statusText}`);
+                operator_src_logger.warn(`Error on getItemByItemPath: ${itemPath}: ${r.statusText}`);
                 throw err;
             }
             return await r.json();
         }
         catch (e) {
-            operator_src_logger.error(`Error on getItemByItemPath: ${e}`);
+            operator_src_logger.warn(`Error on getItemByItemPath: ${e instanceof Error ? e.stack || e.message : JSON.stringify(e)}`);
             throw e;
         }
     });
@@ -331284,13 +331293,13 @@ async function getItemByItemPathOrNull(itemPath, apiGroup = catalog_common/* def
             }
             if (!r.ok) {
                 const err = new Error(`Error on getItemByItemPathOrNull: ${itemPath}: ${r.statusText}`);
-                operator_src_logger.error(`Error on getItemByItemPathOrNull: ${itemPath}: ${r.statusText}`);
+                operator_src_logger.warn(`Error on getItemByItemPathOrNull: ${itemPath}: ${r.statusText}`);
                 throw err;
             }
             return await r.json();
         }
         catch (e) {
-            operator_src_logger.error(`Error on getItemByItemPathOrNull: ${e}`);
+            operator_src_logger.warn(`Error on getItemByItemPathOrNull: ${e instanceof Error ? e.stack || e.message : JSON.stringify(e)}`);
             throw e;
         }
     });
@@ -331456,6 +331465,21 @@ async function upsertResult(namespace, item, result, exitCode = 0, existingRetry
             headers: opts.headers,
             body: JSON.stringify(resultObject),
         });
+        if (r.status === 409) {
+            operator_src_logger.debug(`TFResult '${tfResultName}' already exists (409), updating.`);
+            const existingUrl = `${kc.getCurrentCluster().server}/apis/firestartr.dev/v1/namespaces/${namespace}/tfresults/${tfResultName}`;
+            const getResp = await fetch(existingUrl, { ...opts, method: 'GET' });
+            if (!getResp.ok) {
+                throw `TFResult: failed to fetch existing '${tfResultName}': ${getResp.statusText}`;
+            }
+            const existing = await getResp.json();
+            existing.spec.result = result.toString();
+            const updated = await writeManifest('tfresults', namespace, existing, `apis/firestartr.dev/v1/namespaces/${namespace}/tfresults/${tfResultName}`);
+            await tryWriteTFResultStatus(namespace, tfResultName, updated.metadata.resourceVersion, exitCode, newRetryCount);
+            updated.status = updated.status || {};
+            updated.status.retryCount = newRetryCount;
+            return updated;
+        }
         if (!r.ok) {
             throw `TFResult: ${r.statusText}`;
         }
@@ -332471,15 +332495,20 @@ async function syncer(enqueue) {
 async function loop(enqueueIfNeeded, api) {
     void loopKeeper(api);
     while (1) {
-        await fWait();
-        const needRevisionItems = Object.values(syncWatchers).filter((watcher) => watcher.needsRevision);
-        for (const watcher of needRevisionItems) {
-            const item = await getItemIfNeededSync(watcher);
-            operator_src_logger.debug(`Item needs revision ${watcher.itemPath}`);
-            if (item !== null) {
-                enqueueIfNeeded(item);
+        try {
+            await fWait();
+            const needRevisionItems = Object.values(syncWatchers).filter((watcher) => watcher.needsRevision);
+            for (const watcher of needRevisionItems) {
+                const item = await getItemIfNeededSync(watcher);
+                operator_src_logger.debug(`Item needs revision ${watcher.itemPath}`);
+                if (item !== null) {
+                    enqueueIfNeeded(item);
+                }
+                watcher.needsRevision = false;
             }
-            watcher.needsRevision = false;
+        }
+        catch (err) {
+            operator_src_logger.error(`Error in sync loop: ${err}`);
         }
     }
 }
@@ -332499,15 +332528,34 @@ async function loopKeeper(api) {
         process.exit(1);
     }
 }
-async function getItemIfNeededSync(watcher) {
-    const item = await ctl_getItemByItemPath(watcher.itemPath);
-    const isProvisioning = item.status?.conditions?.find((condition) => condition.type === 'PROVISIONING' && condition.status === 'True');
-    if (isProvisioning)
-        return null;
-    const isDeleting = item.status?.conditions?.find((condition) => condition.type === 'DELETING' && condition.status === 'True');
-    if (isDeleting)
+async function getItemIfNeededSync(watcher, watchers) {
+    const targetWatchers = watchers ?? syncWatchers;
+    try {
+        const item = await ctl_getItemByItemPath(watcher.itemPath);
+        const isProvisioning = item.status?.conditions?.find((condition) => condition.type === 'PROVISIONING' && condition.status === 'True');
+        if (isProvisioning)
+            return null;
+        const isDeleting = item.status?.conditions?.find((condition) => condition.type === 'DELETING' && condition.status === 'True');
+        if (isDeleting)
+            return null;
+        return item;
+    }
+    catch (e) {
+        if (e.message && e.message.includes('Error on getItemByItemPath')) {
+            if (e.message.includes('Not Found')) {
+                operator_src_logger.debug(`Item '${watcher.itemPath}' not found, removing from sync watchers.`);
+                delete targetWatchers[watcher.itemPath];
+            }
+            else {
+                operator_src_logger.warn(`Transient error fetching '${watcher.itemPath}', keeping sync watcher: ${e.message}`);
+            }
+            return null;
+        }
+        else {
+            operator_src_logger.error(e);
+        }
         return null;
-    return item;
+    }
 }
 function fWait(segs = 1) {
     return new Promise((ok) => {
@@ -332515,19 +332563,122 @@ function fWait(segs = 1) {
     });
 }
 
+;// CONCATENATED MODULE: ../operator/src/retry.debug.ts
+
+
+
+
+const RETRY_DEBUG_INTERVAL_MS = 60 * 1000;
+const loggedEvents = new Set();
+function writeEventIfNew(itemPath, counter, next, maxRetry = 5) {
+    const key = `${itemPath}-retry-${counter}`;
+    if (loggedEvents.has(key))
+        return;
+    loggedEvents.add(key);
+    resolveRetryType(itemPath)
+        .then((type) => {
+        const nextStr = next ?? 'none';
+        const line = `${itemPath} - ${type} - retry ${counter + 1}/${maxRetry} - next: ${nextStr}\n`;
+        return new Promise((ok, ko) => {
+            external_fs_.appendFile('/tmp/retries', line, (err) => {
+                if (err)
+                    ko(`Error appending to /tmp/retries: ${err}`);
+                else
+                    ok();
+            });
+        });
+    })
+        .catch(() => {
+        operator_src_logger.warn(`Failed to resolve retry type for ${itemPath}`);
+    });
+}
+function initRetryDebug(retryWatchers, maxRetry) {
+    loggedEvents.clear();
+    try {
+        external_fs_.writeFileSync('/tmp/retries', '');
+    }
+    catch {
+        operator_src_logger.warn('Failed to clear /tmp/retries');
+    }
+    let running = false;
+    setInterval(() => {
+        if (running)
+            return;
+        running = true;
+        writeRetryDebug(retryWatchers, maxRetry)
+            .then(() => {
+            running = false;
+        })
+            .catch((err) => {
+            operator_src_logger.error(`PANIC cannot evaluate the retry debug!!!: ${err}`);
+            running = false;
+        });
+    }, RETRY_DEBUG_INTERVAL_MS);
+}
+async function writeRetryDebug(retryWatchers, maxRetry) {
+    let output = '';
+    for (const watcher of Object.values(retryWatchers)) {
+        const type = await resolveRetryType(watcher.itemPath);
+        const nextStr = watcher.retry
+            ? 'pending'
+            : (watcher.nextRetryAt ?? 'unknown');
+        output += `${watcher.itemPath} - ${type} - retry ${watcher.retryCounter + 1}/${maxRetry} - next: ${nextStr}\n`;
+    }
+    return new Promise((ok, ko) => {
+        external_fs_.writeFile('/tmp/retries', output, (err) => {
+            if (err)
+                ko(`Error writing /tmp/retries: ${err}`);
+            else
+                ok();
+        });
+    });
+}
+async function resolveRetryType(itemPath) {
+    try {
+        const item = await ctl_getItemByItemPath(itemPath);
+        const errorCondition = item.status?.conditions?.find((c) => c.type === 'ERROR' && c.status === 'True');
+        return retryOpForReason(errorCondition?.reason) || 'RETRY';
+    }
+    catch {
+        return 'RETRY';
+    }
+}
+
 ;// CONCATENATED MODULE: ../operator/src/retry.ts
 
 
+
 // Retries now use exponential backoff, starting at 5 minutes
 // and doubling each time, up to the maximum number of retries
-// configured by MAXRETRY.
-const NEXT_RETRY_MS = 1000 * 60 * 5;
-const MAXRETRY = 5;
+// configured by OPERATOR_MAX_RETRY (getMaxRetry()).
+//
+// Both values can be overridden via environment variables for testing:
+//   OPERATOR_NEXT_RETRY_MS  — base delay in ms (default: 300000 = 5 min)
+//   OPERATOR_MAX_RETRY      — max retry attempts (default: 5)
+function getNextRetryMs() {
+    const env = process.env.OPERATOR_NEXT_RETRY_MS;
+    if (env) {
+        const n = Number.parseInt(env, 10);
+        if (Number.isFinite(n) && n > 0)
+            return n;
+    }
+    return 1000 * 60 * 5;
+}
+function getMaxRetry() {
+    const env = process.env.OPERATOR_MAX_RETRY;
+    if (env) {
+        const n = Number.parseInt(env, 10);
+        if (Number.isFinite(n) && n > 0)
+            return n;
+    }
+    return 5;
+}
 function nextRetryMs(currCounter) {
-    return NEXT_RETRY_MS * Math.pow(2, currCounter);
+    return getNextRetryMs() * Math.pow(2, currCounter);
 }
 const retryWatchers = {};
 async function initRetry(enqueue) {
+    initRetryDebug(retryWatchers, getMaxRetry());
     void retry_loop(enqueue);
     return {
         errorReconciling(itemPath) {
@@ -332551,23 +332702,29 @@ function retry(itemPath) {
             retry: false,
             retryCounter: 0,
             nextRetry: null,
+            nextRetryAt: null,
         };
     }
     const currCounter = retryWatchers[itemPath].retryCounter;
-    const delayMs = NEXT_RETRY_MS * Math.pow(2, currCounter);
-    if (currCounter >= MAXRETRY) {
-        operator_src_logger.debug(`Failed to process item '${itemPath}'. Retry limit (${MAXRETRY}) reached. No further retries will be attempted.`);
+    const maxRetry = getMaxRetry();
+    const delayMs = nextRetryMs(currCounter);
+    if (currCounter >= maxRetry) {
+        writeEventIfNew(itemPath, currCounter, null, maxRetry);
+        operator_src_logger.debug(`Failed to process item '${itemPath}'. Retry limit (${maxRetry}) reached. No further retries will be attempted.`);
         removeFromRetry(itemPath);
         return;
     }
-    operator_src_logger.debug(`Failed to process item '${itemPath}'. Retrying in '${delayMs / 1000 / 60}' minutes. Remaining retries: '${MAXRETRY - currCounter - 1}'.`);
+    operator_src_logger.debug(`Failed to process item '${itemPath}'. Retrying in '${delayMs / 1000 / 60}' minutes. Remaining retries: '${maxRetry - currCounter - 1}'.`);
     retryWatchers[itemPath].retry = false;
     if (retryWatchers[itemPath].nextRetry) {
         clearTimeout(retryWatchers[itemPath].nextRetry);
     }
+    retryWatchers[itemPath].nextRetryAt = new Date(Date.now() + delayMs).toISOString();
     retryWatchers[itemPath].nextRetry = setTimeout(() => {
-        if (itemPath in retryWatchers)
+        if (itemPath in retryWatchers) {
             retryWatchers[itemPath].retry = true;
+            retryWatchers[itemPath].nextRetryAt = null;
+        }
     }, delayMs);
 }
 function removeFromRetry(itemPath) {
@@ -332579,7 +332736,8 @@ function removeFromRetry(itemPath) {
 async function retry_loop(enqueueIfNeeded) {
     while (1) {
         await retry_fWait();
-        const needRetryWatchItem = Object.values(retryWatchers).filter((watcher) => watcher.retryCounter < MAXRETRY && watcher.retry);
+        const maxRetry = getMaxRetry();
+        const needRetryWatchItem = Object.values(retryWatchers).filter((watcher) => watcher.retryCounter < maxRetry && watcher.retry);
         for (const watcher of needRetryWatchItem) {
             const item = await getItemIfNeededRetry(watcher);
             if (item !== null) {
@@ -332606,7 +332764,7 @@ async function getItemIfNeededRetry(watcher) {
             return null;
         }
         else {
-            console.error(e);
+            operator_src_logger.warn(`Unexpected error in retry check for '${watcher.itemPath}': ${e}`);
         }
         return null;
     }
@@ -332891,7 +333049,7 @@ function enqueue(pluralKind, workItem, queue, compute, syncCtl, retryCtl) {
             const resolvedExitCode = exitCode !== undefined ? exitCode : /\berror\b/i.test(output) ? 1 : 0;
             const retryCount = result?.status?.retryCount ?? 0;
             const backoffCounter = Math.max(retryCount - 1, 0);
-            const nextRetryTime = resolvedExitCode === 0 || backoffCounter >= MAXRETRY
+            const nextRetryTime = resolvedExitCode === 0 || backoffCounter >= getMaxRetry()
                 ? undefined
                 : new Date(Date.now() + nextRetryMs(backoffCounter)).toISOString();
             await updateRetryStatusInCR(pluralKind, item.metadata.namespace, item.metadata.name, retryCount, nextRetryTime);
@@ -332906,6 +333064,7 @@ function enqueue(pluralKind, workItem, queue, compute, syncCtl, retryCtl) {
         itemPath: () => informer_itemPath(pluralKind, workItem.item),
         error: () => retryCtl.errorReconciling(informer_itemPath(pluralKind, workItem.item)),
         success: () => retryCtl.successReconciling(informer_itemPath(pluralKind, workItem.item)),
+        removeFromRetry: () => retryCtl.successReconciling(informer_itemPath(pluralKind, workItem.item)),
         recommendedTimeout: () => {
             const customTimeoutAnnotation = catalog_common/* default.generic.getFirestartrAnnotation */.Z.generic.getFirestartrAnnotation('test-custom-timeout');
             let customTimeout = null;
@@ -332925,7 +333084,8 @@ function enqueue(pluralKind, workItem, queue, compute, syncCtl, retryCtl) {
             }
             // only for delete operations
             if (operation !== OperationType.MARKED_TO_DELETION) {
-                if (operation === OperationType.RETRY) {
+                if (operation === OperationType.RETRY ||
+                    operation === OperationType.RETRY_SYNC) {
                     // is the retry a delete operation?
                     if (!('deletionTimestamp' in workItem.item.metadata)) {
                         return false;
@@ -332961,13 +333121,15 @@ function enqueue(pluralKind, workItem, queue, compute, syncCtl, retryCtl) {
             operation === OperationType.UPDATED ||
             operation === OperationType.SYNC ||
             operation === OperationType.CREATED ||
-            operation === OperationType.RETRY;
+            operation === OperationType.RETRY ||
+            operation === OperationType.RETRY_SYNC;
         await setSyncStatus(workItem.handler.itemPath(), operation, 'False', 'Sync process started');
         for await (const transition of compute(item, operation, handler)) {
             yield transition;
         }
         if (needsUpdateSyncConditions) {
-            if (operation === OperationType.SYNC) {
+            if (operation === OperationType.SYNC ||
+                operation === OperationType.RETRY_SYNC) {
                 // Fetch the CR once and reuse for both hasSyncFailed check and ERROR guard
                 const currentItem = await ctl_getItemByItemPath(workItem.handler.itemPath());
                 const syncStatus = await getSyncStatus(workItem.handler.itemPath(), currentItem);
@@ -332982,7 +333144,10 @@ function enqueue(pluralKind, workItem, queue, compute, syncCtl, retryCtl) {
                     return;
                 }
             }
-            await setSyncStatus(workItem.handler.itemPath(), operation, operation === OperationType.SYNC ? 'True' : 'False', 'Sync process finished');
+            await setSyncStatus(workItem.handler.itemPath(), operation, operation === OperationType.SYNC ||
+                operation === OperationType.RETRY_SYNC
+                ? 'True'
+                : 'False', 'Sync process finished');
             void syncCtl.updateItem(informer_itemPath(pluralKind, item));
         }
         else {
@@ -333044,18 +333209,21 @@ async function inform(pluralKind, item, op, lastWorkItem = null) {
                 return workItem;
             }
             return null;
-        case 'onRetry':
+        case 'onRetry': {
             if (workItem !== null && workItem.workStatus !== WorkStatus.FINISHED) {
                 return null;
             }
+            const errorCondition = item.status?.conditions?.find((c) => c.type === 'ERROR' && c.status === 'True');
+            const retryOp = retryOpForReason(errorCondition?.reason);
             workItem = {
-                operation: OperationType.RETRY,
+                operation: retryOp,
                 item,
                 workStatus: WorkStatus.PENDING,
                 onDelete: function () { },
                 upsertTime: Date.now(),
             };
             return workItem;
+        }
         case 'onAdd':
             needed = await needsProvisioningOnCreateOrUpdate(item);
             if (needed.needs) {
@@ -333637,7 +333805,8 @@ class DeferredSchedulingBookkeeper {
         const op = item.operation;
         if (op === OperationType.MARKED_TO_DELETION)
             return true;
-        if (op === OperationType.RETRY && item.item?.metadata?.deletionTimestamp)
+        if ((op === OperationType.RETRY || op === OperationType.RETRY_SYNC) &&
+            item.item?.metadata?.deletionTimestamp)
             return true;
         return false;
     }
@@ -333913,6 +334082,7 @@ async function writeDiagnosticSnapshot(queue, maxSlots) {
     const envTfmMirrorRefreshInterval = process.env.TFM_MIRROR_REFRESH_INTERVAL || '900';
     const envBackendProvider = process.env.BACKEND_PROVIDER_NAME || 'kubernetes-provider';
     const envGithubAppId = process.env.GITHUB_APP_ID || '';
+    const envTfmSkipGitConfig = process.env.TFM_SKIP_GIT_CONFIG || 'false';
     // Build YAML output
     let output = '';
     output += `timestamp: "${now}"\n`;
@@ -333925,6 +334095,7 @@ async function writeDiagnosticSnapshot(queue, maxSlots) {
     output += `  TFM_MIRROR_REFRESH_INTERVAL: ${envTfmMirrorRefreshInterval}\n`;
     output += `  BACKEND_PROVIDER_NAME: ${envBackendProvider}\n`;
     output += `  GITHUB_APP_ID: ${envGithubAppId}\n`;
+    output += `  TFM_SKIP_GIT_CONFIG: ${envTfmSkipGitConfig}\n`;
     output += 'queue:\n';
     output += `  total: ${queue.length}\n`;
     output += `  pending: ${pending}\n`;
@@ -334683,6 +334854,7 @@ const WEIGHTS = {
     UPDATED: 10,
     CREATED: 9,
     RETRY: 8,
+    RETRY_SYNC: 8,
     MARKED_TO_DELETION: 6,
     SYNC: 1,
     NOTHING: 0,
@@ -335689,16 +335861,26 @@ async function gitFetchPrune(mirrorPath) {
     });
 }
 /**
- * Single package-wide GitHub authentication config writer for repo mirrors and remote workflows.
  * Writes the required url rewriting stanza to /home/node/.gitconfig based on the current org's GitHub App token.
  * This is the ONLY allowed implementation of project git-auth per package specs.
+ *
+ * When TFM_SKIP_GIT_CONFIG=true is set, the function removes any existing
+ * /home/node/.gitconfig and returns early without writing a new one. This is
+ * used in dev/test environments where no GitHub App credentials are available
+ * (e.g. local dev, smoke tests using prefapp/tfm mirrors).
  */
 async function configGit() {
+    const gitconfigPath = '/home/node/.gitconfig';
+    if (process.env.TFM_SKIP_GIT_CONFIG === 'true') {
+        if (external_fs_.existsSync(gitconfigPath)) {
+            external_fs_.rmSync(gitconfigPath);
+        }
+        return;
+    }
     // Import github dynamically to avoid Jest ESM issues when not specifically running this function
     // (see CONSTITUTION and RULES: must not change test machinery)
     const githubModule = await Promise.resolve(/* import() */).then(__nccwpck_require__.bind(__nccwpck_require__, 99029));
     const github = githubModule.default || githubModule;
-    const gitconfigPath = '/home/node/.gitconfig';
     if (external_fs_.existsSync(gitconfigPath)) {
         external_fs_.rmSync(gitconfigPath);
     }
@@ -337221,8 +337403,8 @@ function policyAllowsOp(policy, op, item) {
             msg = `A RETRY operation is not allowed on a resource with a deletionTimestamp. It means
 that the resource is being deleted and it is not possible to retry the operation with policy: ${policy}.
 
-To fix this issue, you must first delete the "firestatr.dev/finalizer" from finalizers array in the resource manifest,
-it will be automatically deleted by kubernetes. Terraform will not execute any operation on the resource.
+To fix this issue, you must first delete the "firestartr.dev/finalizer" from finalizers array in the resource manifest,
+it will be automatically deleted by Kubernetes. Terraform will not execute any operation on the resource.
 `;
             return { allowed: false, msg };
         }
@@ -337230,6 +337412,19 @@ it will be automatically deleted by kubernetes. Terraform will not execute any o
             return { allowed: true, msg };
         }
     }
+    if (op === OperationType.RETRY_SYNC.toString() &&
+        foundPolicy?.allowedOps.includes(OperationType.SYNC.toString())) {
+        if ('deletionTimestamp' in item.metadata && 'full-control' !== policy) {
+            msg = `A RETRY_SYNC operation is not allowed on a resource with a deletionTimestamp. It means
+that the resource is being deleted and it is not possible to retry the operation with policy: ${policy}.
+
+To fix this issue, you must first delete the "firestartr.dev/finalizer" from finalizers array in the resource manifest,
+it will be automatically deleted by Kubernetes. Terraform will not execute any operation on the resource.
+`;
+            return { allowed: false, msg };
+        }
+        return { allowed: true, msg };
+    }
     if (!foundPolicy) {
         msg = `Policy ${policy} not found`;
         return { allowed: false, msg };
@@ -337432,6 +337627,7 @@ function processOperation(item, op, handler) {
             case OperationType.MARKED_TO_DELETION:
                 return process_operation_markedToDeletion(item, op, handler);
             case OperationType.RETRY:
+            case OperationType.RETRY_SYNC:
                 return process_operation_retry(item, op, handler);
             case OperationType.NOTHING:
                 return process_operation_nothing(item, op, handler);
@@ -337449,11 +337645,26 @@ async function* process_operation_observe(item, op, handler) {
         yield transition;
     }
 }
-async function* doPlanJSONFormat(item, op, handler, setResult = function (_r) { }) {
+async function* doPlanJSONFormat(item, op, handler, setResult = function (_r) { }, emitSyncErrorCondition = true) {
     let error = false;
     let deps;
     let terraformExecutionStarted = false;
     const sessionId = generateSessionId();
+    if (op !== OperationType.RETRY && op !== OperationType.RETRY_SYNC) {
+        try {
+            await handler.writeTerraformOutputInTfResult(item, '', 0);
+        }
+        catch (e) {
+            operator_src_logger.warn(`Failed to clear Terraform output: ${e}`);
+        }
+        try {
+            if (handler.removeFromRetry)
+                handler.removeFromRetry();
+        }
+        catch (e) {
+            operator_src_logger.warn(`Failed to clear retry watcher: ${e}`);
+        }
+    }
     try {
         yield {
             item,
@@ -337582,17 +337793,22 @@ async function* doPlanJSONFormat(item, op, handler, setResult = function (_r) {
             }
         }
         if (error) {
-            if (op === OperationType.SYNC) {
-                // if there is an error on a sync we never put the state on error
-                // it would be problematic because the RETRY op kicks in
-                if (error) {
+            if (op === OperationType.SYNC || op === OperationType.RETRY_SYNC) {
+                if (emitSyncErrorCondition) {
                     yield {
                         item,
                         reason: op,
-                        type: 'SYNCHRONIZED',
+                        type: 'ERROR',
                         status: 'True',
                         message: SYNC_DEFAULT_ERROR_MESSAGE,
                     };
+                    yield {
+                        item,
+                        reason: op,
+                        type: 'SYNCHRONIZED',
+                        status: 'False',
+                        message: SYNC_DEFAULT_ERROR_MESSAGE,
+                    };
                     yield {
                         item,
                         reason: op,
@@ -337614,6 +337830,29 @@ async function* doPlanJSONFormat(item, op, handler, setResult = function (_r) {
                         status: 'False',
                         message: 'doPlanJSONFormat',
                     };
+                }
+                else {
+                    yield {
+                        item,
+                        reason: op,
+                        type: 'SYNCHRONIZED',
+                        status: 'True',
+                        message: SYNC_DEFAULT_ERROR_MESSAGE,
+                    };
+                    yield {
+                        item,
+                        reason: op,
+                        type: 'PROVISIONED',
+                        status: 'True',
+                        message: 'doPlanJSONFormat',
+                    };
+                    yield {
+                        item,
+                        reason: op,
+                        type: 'PLANNING',
+                        status: 'False',
+                        message: 'doPlanJSONFormat',
+                    };
                     yield {
                         item,
                         reason: op,
@@ -337656,9 +337895,16 @@ async function* doPlanJSONFormat(item, op, handler, setResult = function (_r) {
             }
         }
         else {
-            if (op === OperationType.SYNC) {
+            handler.success();
+            if (op === OperationType.SYNC || op === OperationType.RETRY_SYNC) {
                 setResult('SYNC_SUCCESS');
             }
+            try {
+                await handler.writeTerraformOutputInTfResult(item, '', 0);
+            }
+            catch (e) {
+                operator_src_logger.warn(`Failed to clear Terraform output: ${e}`);
+            }
         }
     }
 }
@@ -337688,6 +337934,13 @@ async function* process_operation_retry(item, op, handler) {
             yield transition;
         }
     }
+    else if (op === OperationType.RETRY_SYNC) {
+        const policy = getPolicy(item, 'firestartr.dev/policy');
+        const syncPolicy = getPolicy(item, 'firestartr.dev/sync-policy');
+        for await (const transition of process_operation_sync(item, OperationType.RETRY_SYNC, handler, syncPolicy, policy)) {
+            yield transition;
+        }
+    }
     else {
         for await (const transition of doApply(item, op, handler)) {
             yield transition;
@@ -337704,7 +337957,7 @@ async function* process_operation_sync(item, op, handler, syncPolicy, generalPol
     let doResult = '';
     if (!syncPolicy) {
         operator_src_logger.debug(`The Terraform processor is only observing item '${item.kind}/${item.metadata.name}' because no sync policy was found for operation '${op}'.`);
-        yield* doPlanJSONFormat(item, op, handler);
+        yield* doPlanJSONFormat(item, op, handler, undefined, false);
         return;
     }
     else if (!catalog_common/* default.policies.policiesAreCompatible */.Z.policies.policiesAreCompatible(syncPolicy, generalPolicy)) {
@@ -337749,6 +338002,9 @@ async function* process_operation_markedToDeletion(item, op, handler) {
     let terraformExecutionStarted = false;
     const sessionId = generateSessionId();
     try {
+        if (op === OperationType.MARKED_TO_DELETION) {
+            await handler.writeTerraformOutputInTfResult(item, '', 0);
+        }
         const type = 'DELETING';
         yield {
             item,
@@ -337898,6 +338154,21 @@ async function* doApply(item, op, handler) {
     let deps;
     let terraformExecutionStarted = false;
     const sessionId = generateSessionId();
+    if (op !== OperationType.RETRY && op !== OperationType.RETRY_SYNC) {
+        try {
+            await handler.writeTerraformOutputInTfResult(item, '', 0);
+        }
+        catch (e) {
+            operator_src_logger.warn(`Failed to clear Terraform output: ${e}`);
+        }
+        try {
+            if (handler.removeFromRetry)
+                handler.removeFromRetry();
+        }
+        catch (e) {
+            operator_src_logger.warn(`Failed to clear retry watcher: ${e}`);
+        }
+    }
     try {
         yield {
             item,
@@ -342152,6 +342423,7 @@ function process_operation_processOperation(item, op, handler) {
             case OperationType.MARKED_TO_DELETION:
                 return gh_process_operation_markedToDeletion(item, op, handler);
             case OperationType.RETRY:
+            case OperationType.RETRY_SYNC:
                 return gh_process_operation_retry(item, op, handler);
             case OperationType.NOTHING:
                 return gh_process_operation_nothing(item, op, handler);
@@ -342188,6 +342460,11 @@ async function* gh_process_operation_retry(item, op, handler) {
             yield transition;
         }
     }
+    else if (op === OperationType.RETRY_SYNC) {
+        for await (const transition of gh_process_operation_sync(item, OperationType.RETRY_SYNC, handler)) {
+            yield transition;
+        }
+    }
     else {
         for await (const transition of process_operation_doApply(item, op, handler)) {
             yield transition;
@@ -342340,6 +342617,14 @@ async function* process_operation_doApply(item, op, handler) {
     let checkRunCtl;
     let checkRunTFCtl;
     let error = false;
+    if (op !== OperationType.RETRY && op !== OperationType.RETRY_SYNC) {
+        try {
+            await handler.writeTerraformOutputInTfResult(item, '', 0);
+        }
+        catch (e) {
+            operator_src_logger.warn(`Failed to reset retry count: ${e instanceof Error ? e.stack || e.message : JSON.stringify(e)}`);
+        }
+    }
     try {
         yield {
             item,
@@ -342373,6 +342658,7 @@ async function* process_operation_doApply(item, op, handler) {
         if (op === OperationType.UPDATED ||
             op === OperationType.RENAMED ||
             op === OperationType.RETRY ||
+            op === OperationType.RETRY_SYNC ||
             op === OperationType.SYNC) {
             opts['update'] = true;
         }
@@ -521630,7 +521916,7 @@ const crsStatusSubcommand = {
 };
 
 ;// CONCATENATED MODULE: ./package.json
-const package_namespaceObject = JSON.parse('{"i8":"2.8.0-snapshot-variant-cloning-test-1"}');
+const package_namespaceObject = JSON.parse('{"i8":"2.8.0-snapshot-variant-cloning-1"}');
 ;// CONCATENATED MODULE: ../../package.json
 const package_namespaceObject_1 = {"i8":"2.7.1"};
 ;// CONCATENATED MODULE: ./src/subcommands/index.ts

package/build/packages/cdk8s_renderer/src/claims/base/schemas/index.d.ts

@@ -1238,10 +1238,6 @@ declare const schemas: {
                 description: string;
                 type: string;
                 properties: {
-                    name: {
-                        type: string;
-                        description: string;
-                    };
                     values: {
                         type: string;
                         additionalProperties: boolean;
@@ -1320,6 +1316,7 @@ declare const schemas: {
                 properties: {
                     name: {
                         type: string;
+                        maxLength: number;
                         description: string;
                     };
                     overrides: {

package/build/packages/cdk8s_renderer/src/claims/tfworkspaces/index.d.ts

@@ -143,10 +143,6 @@ export declare const TerraformSchemas: {
             description: string;
             type: string;
             properties: {
-                name: {
-                    type: string;
-                    description: string;
-                };
                 values: {
                     type: string;
                     additionalProperties: boolean;
@@ -225,6 +221,7 @@ export declare const TerraformSchemas: {
             properties: {
                 name: {
                     type: string;
+                    maxLength: number;
                     description: string;
                 };
                 overrides: {

package/build/packages/cdk8s_renderer/src/claims/tfworkspaces/terraform.schema.d.ts

@@ -143,10 +143,6 @@ declare const _default: {
             description: string;
             type: string;
             properties: {
-                name: {
-                    type: string;
-                    description: string;
-                };
                 values: {
                     type: string;
                     additionalProperties: boolean;
@@ -225,6 +221,7 @@ declare const _default: {
             properties: {
                 name: {
                     type: string;
+                    maxLength: number;
                     description: string;
                 };
                 overrides: {

package/build/packages/operator/src/definitions.d.ts

@@ -22,8 +22,10 @@ export declare enum OperationType {
     SYNC = "SYNC",
     MARKED_TO_DELETION = "MARKED_TO_DELETION",
     NOTHING = "NOTHING",
-    RETRY = "RETRY"
+    RETRY = "RETRY",
+    RETRY_SYNC = "RETRY_SYNC"
 }
+export declare function retryOpForReason(reason: string | undefined): OperationType;
 export declare enum WorkStatus {
     PENDING = "PENDING",
     PROCESSING = "PROCESSING",
@@ -65,6 +67,7 @@ export type WorkItemHandler = {
     itemPath: ItemPathFn;
     error: ErrorFn;
     success: SuccessFn;
+    removeFromRetry?: () => void;
     isBlocked?: boolean;
     isPicked?: boolean;
     needsBlocking?: (item: any, operation: OperationType) => boolean;

package/build/packages/operator/src/gh/process-operation.d.ts

@@ -6,3 +6,17 @@ export declare function processOperation(item: any, op: OperationType, handler:
     status: string;
     message: string;
 }, void, unknown>;
+export declare function retry(item: any, op: OperationType, handler: any): AsyncGenerator<{
+    item: any;
+    reason: OperationType;
+    type: string;
+    status: string;
+    message: string;
+}, void, unknown>;
+export declare function sync(item: any, op: OperationType, handler: any): AsyncGenerator<{
+    item: any;
+    reason: OperationType;
+    type: string;
+    status: string;
+    message: string;
+}, void, unknown>;

package/build/packages/operator/src/retry.d.ts

@@ -1,5 +1,4 @@
-export declare const NEXT_RETRY_MS: number;
-export declare const MAXRETRY = 5;
+export declare function getMaxRetry(): number;
 export declare function nextRetryMs(currCounter: number): number;
 export declare function initRetry(enqueue: Function): Promise<{
     errorReconciling(itemPath: string): void;

package/build/packages/operator/src/retry.debug.d.ts

@@ -0,0 +1,11 @@
+type RetryWatcher = {
+    itemPath: string;
+    retryCounter: number;
+    retry: boolean;
+    nextRetryAt: string | null;
+};
+export declare function writeEventIfNew(itemPath: string, counter: number, next: string | null, maxRetry?: number): void;
+export declare function initRetryDebug(retryWatchers: {
+    [key: string]: RetryWatcher;
+}, maxRetry: number): void;
+export {};

package/build/packages/operator/src/syncer.d.ts

@@ -8,3 +8,6 @@ export declare function syncer(enqueue: Function): Promise<{
     deleteItem(itemPath: string): void;
 }>;
 export declare function loop(enqueueIfNeeded: Function, api: any): Promise<void>;
+export declare function getItemIfNeededSync(watcher: any, watchers?: {
+    [key: string]: SyncWatcher;
+}): Promise<any>;

package/build/packages/operator/src/tfworkspaces/process-operation.d.ts

@@ -7,6 +7,27 @@ export declare function processOperation(item: any, op: OperationType, handler:
     status: string;
     message: any;
 }, void, unknown>;
+export declare function doPlanJSONFormat(item: any, op: OperationType, handler: any, setResult?: (_r: string) => void, emitSyncErrorCondition?: boolean): AsyncGenerator<{
+    item: any;
+    reason: OperationType;
+    type: string;
+    status: string;
+    message: any;
+}, void, unknown>;
+export declare function retry(item: any, op: OperationType, handler: any): AsyncGenerator<{
+    item: any;
+    reason: OperationType;
+    type: string;
+    status: string;
+    message: any;
+}, void, unknown>;
+export declare function sync(item: any, op: OperationType, handler: any, syncPolicy: string, generalPolicy: string): AsyncGenerator<{
+    item: any;
+    reason: OperationType;
+    type: string;
+    status: string;
+    message: any;
+}, void, unknown>;
 /**
  *
  * @param {any} item - CR to be applied

package/build/packages/terraform_provisioner/src/utils.d.ts

@@ -38,8 +38,12 @@ export declare function gitRemoteUpdate(mirrorPath: string): Promise<void>;
  */
 export declare function gitFetchPrune(mirrorPath: string): Promise<void>;
 /**
- * Single package-wide GitHub authentication config writer for repo mirrors and remote workflows.
  * Writes the required url rewriting stanza to /home/node/.gitconfig based on the current org's GitHub App token.
  * This is the ONLY allowed implementation of project git-auth per package specs.
+ *
+ * When TFM_SKIP_GIT_CONFIG=true is set, the function removes any existing
+ * /home/node/.gitconfig and returns early without writing a new one. This is
+ * used in dev/test environments where no GitHub App credentials are available
+ * (e.g. local dev, smoke tests using prefapp/tfm mirrors).
  */
 export declare function configGit(): Promise<void>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@firestartr/cli",
-  "version": "2.8.0-snapshot-variant-cloning-test-1",
+  "version": "2.8.0-snapshot-variant-cloning-1",
   "private": false,
   "description": "Commandline tool",
   "main": "build/main.js",