kubernetes-fluent-client 3.11.6 → 3.11.7

package/dist/fetch.d.ts

@@ -1,4 +1,4 @@
-import { RequestInfo, RequestInit } from "undici";
+import { Headers, RequestInfo, RequestInit } from "undici";
 export type FetchResponse<T> = {
     data: T;
     ok: boolean;

package/dist/fetch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fetch.d.ts","sourceRoot":"","sources":["../src/fetch.ts"],"names":[],"mappings":"AAIA,OAAO,EAAwB,WAAW,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AAExE,MAAM,MAAM,aAAa,CAAC,CAAC,IAAI;IAC7B,IAAI,EAAE,CAAC,CAAC;IACR,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,CAAC,CAAC,EAAE,OAAO,CAAC;CACb,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,wBAAsB,KAAK,CAAC,CAAC,EAC3B,GAAG,EAAE,GAAG,GAAG,WAAW,EACtB,IAAI,CAAC,EAAE,WAAW,GACjB,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CA2C3B"}
+{"version":3,"file":"fetch.d.ts","sourceRoot":"","sources":["../src/fetch.ts"],"names":[],"mappings":"AAIA,OAAO,EAAwB,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AAEjF,MAAM,MAAM,aAAa,CAAC,CAAC,IAAI;IAC7B,IAAI,EAAE,CAAC,CAAC;IACR,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,CAAC,CAAC,EAAE,OAAO,CAAC;CACb,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,wBAAsB,KAAK,CAAC,CAAC,EAC3B,GAAG,EAAE,GAAG,GAAG,WAAW,EACtB,IAAI,CAAC,EAAE,WAAW,GACjB,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CA2C3B"}

package/dist/fetch.js

@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: Apache-2.0
 // SPDX-FileCopyrightText: 2023-Present The Kubernetes Fluent Client Authors
 import { StatusCodes } from "http-status-codes";
-import { fetch as undiciFetch } from "undici";
+import { fetch as undiciFetch, Headers } from "undici";
 /**
  * Perform an async HTTP call and return the parsed JSON response, optionally
  * as a specific type.
@@ -39,7 +39,7 @@ export async function fetch(url, init) {
             // Otherwise, return however the response was read
             data = (await resp.text());
         }
-        return { data, ok, status, statusText, headers };
+        return { data, ok, status, statusText, headers: headers };
     }
     catch (e) {
         // Always treat a catch as a failure for callers — even when the HTTP

package/dist/fluent/watch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"watch.d.ts","sourceRoot":"","sources":["../../src/fluent/watch.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAGtC,OAAO,EAAE,YAAY,EAAwB,MAAM,aAAa,CAAC;AACjE,OAAO,EAEL,OAAO,EAEP,WAAW,EAEZ,MAAM,mBAAmB,CAAC;AAG3B,oBAAY,UAAU;IACpB,sCAAsC;IACtC,OAAO,YAAY;IACnB,2BAA2B;IAC3B,aAAa,kBAAkB;IAC/B,kDAAkD;IAClD,UAAU,eAAe;IACzB,0BAA0B;IAC1B,SAAS,cAAc;IACvB,8BAA8B;IAC9B,OAAO,YAAY;IACnB,sBAAsB;IACtB,KAAK,UAAU;IACf,mCAAmC;IACnC,IAAI,SAAS;IACb,wCAAwC;IACxC,oBAAoB,yBAAyB;IAC7C,qCAAqC;IACrC,iBAAiB,sBAAsB;IACvC,kCAAkC;IAClC,IAAI,SAAS;IACb,2BAA2B;IAC3B,UAAU,eAAe;IACzB,mBAAmB;IACnB,UAAU,eAAe;IACzB,qCAAqC;IACrC,wBAAwB,6BAA6B;IACrD,iCAAiC;IACjC,eAAe,oBAAoB;IACnC,4BAA4B;IAC5B,WAAW,gBAAgB;CAC5B;AAED,4CAA4C;AAC5C,MAAM,MAAM,QAAQ,GAAG;IACrB,+HAA+H;IAC/H,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,wDAAwD;IACxD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,+FAA+F;IAC/F,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,wHAAwH;IACxH,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B,CAAC;AAKF,iDAAiD;AACjD,qBAAa,OAAO,CAAC,CAAC,SAAS,YAAY;;IAyBzC,YAAY,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC;IAc9B;;;;;;;;;;;OAWG;gBACS,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,QAAQ,GAAE,QAAa;IA0CzF;;;;OAIG;IACU,KAAK,IAAI,OAAO,CAAC,eAAe,CAAC;IAO9C,gGAAgG;IACzF,KAAK;IAQZ;;;;;;OAMG;IACH,IAAW,MAAM,IAAI,YAAY,CAEhC;CAuaF"}
+{"version":3,"file":"watch.d.ts","sourceRoot":"","sources":["../../src/fluent/watch.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAGtC,OAAO,EAAE,YAAY,EAAwB,MAAM,aAAa,CAAC;AACjE,OAAO,EAEL,OAAO,EAEP,WAAW,EAEZ,MAAM,mBAAmB,CAAC;AAG3B,oBAAY,UAAU;IACpB,sCAAsC;IACtC,OAAO,YAAY;IACnB,2BAA2B;IAC3B,aAAa,kBAAkB;IAC/B,kDAAkD;IAClD,UAAU,eAAe;IACzB,0BAA0B;IAC1B,SAAS,cAAc;IACvB,8BAA8B;IAC9B,OAAO,YAAY;IACnB,sBAAsB;IACtB,KAAK,UAAU;IACf,mCAAmC;IACnC,IAAI,SAAS;IACb,wCAAwC;IACxC,oBAAoB,yBAAyB;IAC7C,qCAAqC;IACrC,iBAAiB,sBAAsB;IACvC,kCAAkC;IAClC,IAAI,SAAS;IACb,2BAA2B;IAC3B,UAAU,eAAe;IACzB,mBAAmB;IACnB,UAAU,eAAe;IACzB,qCAAqC;IACrC,wBAAwB,6BAA6B;IACrD,iCAAiC;IACjC,eAAe,oBAAoB;IACnC,4BAA4B;IAC5B,WAAW,gBAAgB;CAC5B;AAED,4CAA4C;AAC5C,MAAM,MAAM,QAAQ,GAAG;IACrB,+HAA+H;IAC/H,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,wDAAwD;IACxD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,+FAA+F;IAC/F,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,wHAAwH;IACxH,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B,CAAC;AAKF,iDAAiD;AACjD,qBAAa,OAAO,CAAC,CAAC,SAAS,YAAY;;IAyBzC,YAAY,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC;IAiB9B;;;;;;;;;;;OAWG;gBACS,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,QAAQ,GAAE,QAAa;IA+CzF;;;;OAIG;IACU,KAAK,IAAI,OAAO,CAAC,eAAe,CAAC;IAO9C,gGAAgG;IACzF,KAAK;IAQZ;;;;;;OAMG;IACH,IAAW,MAAM,IAAI,YAAY,CAEhC;CAgdF"}

package/dist/fluent/watch.js

@@ -4,7 +4,7 @@ import { EventEmitter } from "events";
 import { Readable } from "stream";
 import { fetch } from "undici";
 import { FetchMethods, WatchPhase, } from "./shared-types.js";
-import { getHeaders, k8sCfg, pathBuilder, sleep, startSleep } from "./utils.js";
+import { getHeaders, k8sCfg, pathBuilder, sleep } from "./utils.js";
 export var WatchEvent;
 (function (WatchEvent) {
     /** Watch is connected successfully */
@@ -65,6 +65,8 @@ export class Watcher {
     #resyncTimer;
     // Track if a reconnect is pending
     #pendingReconnect = false;
+    // Track if a list operation is in progress to prevent concurrent lists
+    #listInProgress = false;
     // The resource version to start the watch at, this will be updated after the list operation.
     #resourceVersion;
     // Track the list of items in the cache
@@ -98,7 +100,12 @@ export class Watcher {
         this.$relistTimer = setInterval(() => {
             this.#latestRelistWindow = new Date().toISOString();
             this.#events.emit(WatchEvent.INIT_CACHE_MISS, this.#latestRelistWindow);
-            void this.#list();
+            void (async () => {
+                const success = await this.#list();
+                if (!success) {
+                    this.#lastSeenTime = OVERRIDE;
+                }
+            })();
         }, watchCfg.relistIntervalSec * 1000 + jitter);
         // Rebuild the watch every resync delay interval
         this.#resyncTimer = setInterval(this.#checkResync, watchCfg.resyncDelaySec * 1000 + jitter);
@@ -176,9 +183,17 @@ export class Watcher {
      * @param continueToken - the continue token for the list
      * @param removedItems - the list of items that have been removed
      * @param retryCount - current retry attempt count
+     * @param pageCount - number of continuation pages already fetched (0-based)
      * @returns resolves when list processing is complete
      */
-    #list = async (continueToken, removedItems, retryCount = 0) => {
+    #list = async (continueToken, removedItems, retryCount = 0, pageCount = 0) => {
+        const isTopLevel = !continueToken && !removedItems && retryCount === 0;
+        if (isTopLevel) {
+            if (this.#listInProgress) {
+                return false;
+            }
+            this.#listInProgress = true;
+        }
         const maxRetries = 5;
         const maxPages = 10;
         try {
@@ -192,18 +207,16 @@ export class Watcher {
                 const retryAfterHeader = response.headers.get("retry-after");
                 // Retry with exponential backoff if under retry limit to prevent infinite recursion if the server is returning errors
                 if (retryCount < maxRetries && retryAfterHeader) {
-                    const backoffTime = retryAfterHeader
-                        ? parseInt(retryAfterHeader) * 1000
-                        : Math.min(startSleep * Math.pow(2, retryCount), 30000);
+                    const backoffTime = parseInt(retryAfterHeader) * 1000;
                     await sleep(backoffTime);
                     try {
-                        return this.#list(continueToken, removedItems, retryCount + 1);
+                        return await this.#list(continueToken, removedItems, retryCount + 1, pageCount);
                     }
                     catch (e) {
                         this.#events.emit(WatchEvent.LIST_ERROR, `retry list failed attempt ${retryCount}: ${e}`);
                     }
                 }
-                return;
+                return false;
             }
             // Unconditionally assign the continue token from the response so that it is cleared on the last page
             continueToken = list.metadata.continue;
@@ -213,6 +226,7 @@ export class Watcher {
             this.#resourceVersion = list.metadata?.resourceVersion;
             // If removed items are not provided, clone the cache
             removedItems = removedItems || new Map(this.#cache.entries());
+            let anyCallbackFailed = false;
             // Process each item in the list
             for (const item of list.items || []) {
                 const { uid } = item.metadata;
@@ -221,8 +235,15 @@ export class Watcher {
                 // If the item does not exist, it is new and should be added
                 if (!alreadyExists) {
                     this.#events.emit(WatchEvent.CACHE_MISS, this.#latestRelistWindow);
-                    // Send added event. Use void here because we don't care about the result (no consequences here if it fails)
-                    void this.#process(item, WatchPhase.Added);
+                    try {
+                        // Keep lastSeenTime fresh to prevent spurious resync during slow list processing
+                        this.#lastSeenTime = Date.now();
+                        await this.#process(item, WatchPhase.Added);
+                    }
+                    catch (err) {
+                        anyCallbackFailed = true;
+                        this.#events.emit(WatchEvent.DATA_ERROR, err);
+                    }
                     continue;
                 }
                 // Check if the resource version has changed for items that already exist
@@ -231,30 +252,53 @@ export class Watcher {
                 // Check if the resource version is newer than the cached version
                 if (itemRV > cachedRV) {
                     this.#events.emit(WatchEvent.CACHE_MISS, this.#latestRelistWindow);
-                    // Send a modified event if the resource version has changed
-                    void this.#process(item, WatchPhase.Modified);
+                    try {
+                        this.#lastSeenTime = Date.now();
+                        await this.#process(item, WatchPhase.Modified);
+                    }
+                    catch (err) {
+                        anyCallbackFailed = true;
+                        this.#events.emit(WatchEvent.DATA_ERROR, err);
+                    }
                 }
             }
             // If there is a continue token, call the list function again with the same removed items
             if (continueToken) {
                 // Safeguard against infinite pagination
-                if (retryCount >= maxPages) {
+                if (pageCount >= maxPages) {
                     this.#events.emit(WatchEvent.LIST_ERROR, new Error(`Maximum pagination limit (${maxPages}) reached, stopping list operation`));
-                    return;
+                    return false;
                 }
-                // Continue pagination (not a retry, so reset retryCount to 0)
-                await this.#list(continueToken, removedItems, 0);
+                // Continue pagination (not a retry, so reset retryCount to 0).
+                // Combine with current page's failure state so a callback failure on
+                // an earlier page is not masked by a successful later page.
+                const nextPageSucceeded = await this.#list(continueToken, removedItems, 0, pageCount + 1);
+                return !anyCallbackFailed && nextPageSucceeded;
             }
             else {
                 // Otherwise, process the removed items
                 for (const item of removedItems.values()) {
                     this.#events.emit(WatchEvent.CACHE_MISS, this.#latestRelistWindow);
-                    void this.#process(item, WatchPhase.Deleted);
+                    try {
+                        this.#lastSeenTime = Date.now();
+                        await this.#process(item, WatchPhase.Deleted);
+                    }
+                    catch (err) {
+                        anyCallbackFailed = true;
+                        this.#events.emit(WatchEvent.DATA_ERROR, err);
+                    }
                 }
             }
+            return !anyCallbackFailed;
         }
         catch (err) {
             this.#events.emit(WatchEvent.LIST_ERROR, err);
+            return false;
+        }
+        finally {
+            if (isTopLevel) {
+                this.#listInProgress = false;
+            }
         }
     };
     /**
@@ -264,26 +308,21 @@ export class Watcher {
      * @param phase - the event phase
      */
     #process = async (payload, phase) => {
-        try {
-            switch (phase) {
-                // If the event is added or modified, update the cache
-                case WatchPhase.Added:
-                case WatchPhase.Modified:
-                    this.#cache.set(payload.metadata.uid, payload);
-                    break;
-                // If the event is deleted, remove the item from the cache
-                case WatchPhase.Deleted:
-                    this.#cache.delete(payload.metadata.uid);
-                    break;
-            }
-            // Emit the data event
-            this.#events.emit(WatchEvent.DATA, payload, phase);
-            // Call the callback function with the parsed payload
-            await this.#callback(payload, phase);
-        }
-        catch (err) {
-            this.#events.emit(WatchEvent.DATA_ERROR, err);
+        // Call the callback function — if it throws, the cache is NOT updated
+        // so the next relist will detect the item as unprocessed and retry
+        await this.#callback(payload, phase);
+        // Only update cache after the callback succeeds
+        switch (phase) {
+            case WatchPhase.Added:
+            case WatchPhase.Modified:
+                this.#cache.set(payload.metadata.uid, payload);
+                break;
+            case WatchPhase.Deleted:
+                this.#cache.delete(payload.metadata.uid);
+                break;
         }
+        // Emit data event only after callback succeeds and cache is updated
+        this.#events.emit(WatchEvent.DATA, payload, phase);
     };
     // process a line from the chunk
     #processLine = async (line, process) => {
@@ -299,7 +338,9 @@ export class Watcher {
                     message: this.#resourceVersion,
                 };
             }
-            // Process the event payload, do not update the resource version as that is handled by the list operation
+            // Process the event payload, do not update the resource version as that is handled by the list operation.
+            // Watch-stream events are not retried on callback failure — the relist timer
+            // will re-detect unprocessed items on its next cycle.
             await process(payload, phase);
         }
         catch (err) {
@@ -318,13 +359,18 @@ export class Watcher {
      */
     #watch = async (retryCount = 0) => {
         const maxRetries = 5;
-        // Start with a list operation, but don't let it block the watch stream
+        // Start with a list operation
+        let listSucceeded = false;
         try {
-            await this.#list();
+            listSucceeded = await this.#list();
         }
         catch (listError) {
             this.#events.emit(WatchEvent.LIST_ERROR, listError);
         }
+        // If the list failed, trigger a faster resync so items aren't permanently missed
+        if (!listSucceeded) {
+            this.#lastSeenTime = OVERRIDE;
+        }
         // Build the URL and request options
         try {
             const { opts, serverUrl } = await this.#buildURL(true, this.#resourceVersion);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kubernetes-fluent-client",
-  "version": "3.11.6",
+  "version": "3.11.7",
   "description": "A @kubernetes/client-node fluent API wrapper that leverages K8s Server Side Apply.",
   "bin": "./dist/cli.js",
   "main": "dist/index.js",
@@ -56,12 +56,12 @@
     "node-fetch": "2.7.0",
     "quicktype-core": "23.2.6",
     "tsx": "4.21.0",
-    "undici": "7.24.1",
+    "undici": "7.24.6",
     "yargs": "18.0.0"
   },
   "devDependencies": {
-    "@commitlint/cli": "20.4.3",
-    "@commitlint/config-conventional": "20.4.3",
+    "@commitlint/cli": "20.5.0",
+    "@commitlint/config-conventional": "20.5.0",
     "@defenseunicorns/eslint-config": "1.2.0",
     "@eslint/eslintrc": "3.3.5",
     "@eslint/js": "10.0.1",
@@ -70,22 +70,23 @@
     "@types/urijs": "1.19.26",
     "@types/ws": "8.18.1",
     "@types/yargs": "17.0.35",
-    "@typescript-eslint/eslint-plugin": "8.56.1",
-    "@typescript-eslint/parser": "8.56.1",
-    "@vitest/coverage-v8": "4.0.18",
-    "command-line-args": "6.0.1",
-    "eslint": "10.0.3",
-    "eslint-plugin-jsdoc": "62.7.1",
-    "globals": "17.4.0",
+    "@typescript-eslint/eslint-plugin": "8.58.2",
+    "@typescript-eslint/parser": "8.58.2",
+    "@vitest/coverage-v8": "4.1.4",
+    "command-line-args": "6.0.2",
+    "eslint": "10.2.0",
+    "eslint-plugin-jsdoc": "62.9.0",
+    "globals": "17.5.0",
     "husky": "9.1.7",
-    "lint-staged": "16.3.2",
-    "prettier": "3.8.1",
+    "lint-staged": "16.4.0",
+    "prettier": "3.8.3",
     "semantic-release": "25.0.3",
-    "typescript": "5.9.3",
-    "vitest": "4.0.18"
+    "typescript": "6.0.2",
+    "vitest": "4.1.4"
   },
   "overrides": {
     "tar-fs": "3.1.1",
+    "typescript-eslint": "8.58.0",
     "semantic-release@24.2.0": {
       "npm": {
         "glob": {

package/src/fetch.ts

@@ -2,7 +2,7 @@
 // SPDX-FileCopyrightText: 2023-Present The Kubernetes Fluent Client Authors
 
 import { StatusCodes } from "http-status-codes";
-import { fetch as undiciFetch, RequestInfo, RequestInit } from "undici";
+import { fetch as undiciFetch, Headers, RequestInfo, RequestInit } from "undici";
 
 export type FetchResponse<T> = {
   data: T;
@@ -57,7 +57,7 @@ export async function fetch<T>(
       data = (await resp.text()) as unknown as T;
     }
 
-    return { data, ok, status, statusText, headers };
+    return { data, ok, status, statusText, headers: headers! };
   } catch (e) {
     // Always treat a catch as a failure for callers — even when the HTTP
     // transport returned 2xx, a body-parse error means `data` is unusable.

package/src/fluent/watch.ts

@@ -12,7 +12,7 @@ import {
   WatchAction,
   WatchPhase,
 } from "./shared-types.js";
-import { getHeaders, k8sCfg, pathBuilder, sleep, startSleep } from "./utils.js";
+import { getHeaders, k8sCfg, pathBuilder, sleep } from "./utils.js";
 
 export enum WatchEvent {
   /** Watch is connected successfully */
@@ -96,6 +96,9 @@ export class Watcher<T extends GenericClass> {
   // Track if a reconnect is pending
   #pendingReconnect = false;
 
+  // Track if a list operation is in progress to prevent concurrent lists
+  #listInProgress = false;
+
   // The resource version to start the watch at, this will be updated after the list operation.
   #resourceVersion?: string;
 
@@ -138,7 +141,12 @@ export class Watcher<T extends GenericClass> {
       () => {
         this.#latestRelistWindow = new Date().toISOString();
         this.#events.emit(WatchEvent.INIT_CACHE_MISS, this.#latestRelistWindow);
-        void this.#list();
+        void (async () => {
+          const success = await this.#list();
+          if (!success) {
+            this.#lastSeenTime = OVERRIDE;
+          }
+        })();
       },
       watchCfg.relistIntervalSec * 1000 + jitter,
     );
@@ -238,13 +246,23 @@ export class Watcher<T extends GenericClass> {
    * @param continueToken - the continue token for the list
    * @param removedItems - the list of items that have been removed
    * @param retryCount - current retry attempt count
+   * @param pageCount - number of continuation pages already fetched (0-based)
    * @returns resolves when list processing is complete
    */
   #list = async (
     continueToken?: string,
     removedItems?: Map<string, InstanceType<T>>,
     retryCount = 0,
-  ): Promise<void> => {
+    pageCount = 0,
+  ): Promise<boolean> => {
+    const isTopLevel = !continueToken && !removedItems && retryCount === 0;
+    if (isTopLevel) {
+      if (this.#listInProgress) {
+        return false;
+      }
+      this.#listInProgress = true;
+    }
+
     const maxRetries = 5;
     const maxPages = 10;
 
@@ -266,13 +284,11 @@ export class Watcher<T extends GenericClass> {
         const retryAfterHeader = response.headers.get("retry-after");
         // Retry with exponential backoff if under retry limit to prevent infinite recursion if the server is returning errors
         if (retryCount < maxRetries && retryAfterHeader) {
-          const backoffTime = retryAfterHeader
-            ? parseInt(retryAfterHeader) * 1000
-            : Math.min(startSleep * Math.pow(2, retryCount), 30000);
+          const backoffTime = parseInt(retryAfterHeader) * 1000;
 
           await sleep(backoffTime);
           try {
-            return this.#list(continueToken, removedItems, retryCount + 1);
+            return await this.#list(continueToken, removedItems, retryCount + 1, pageCount);
           } catch (e) {
             this.#events.emit(
               WatchEvent.LIST_ERROR,
@@ -281,7 +297,7 @@ export class Watcher<T extends GenericClass> {
           }
         }
 
-        return;
+        return false;
       }
 
       // Unconditionally assign the continue token from the response so that it is cleared on the last page
@@ -296,6 +312,8 @@ export class Watcher<T extends GenericClass> {
       // If removed items are not provided, clone the cache
       removedItems = removedItems || new Map(this.#cache.entries());
 
+      let anyCallbackFailed = false;
+
       // Process each item in the list
       for (const item of list.items || []) {
         const { uid } = item.metadata;
@@ -306,8 +324,14 @@ export class Watcher<T extends GenericClass> {
         // If the item does not exist, it is new and should be added
         if (!alreadyExists) {
           this.#events.emit(WatchEvent.CACHE_MISS, this.#latestRelistWindow);
-          // Send added event. Use void here because we don't care about the result (no consequences here if it fails)
-          void this.#process(item, WatchPhase.Added);
+          try {
+            // Keep lastSeenTime fresh to prevent spurious resync during slow list processing
+            this.#lastSeenTime = Date.now();
+            await this.#process(item, WatchPhase.Added);
+          } catch (err) {
+            anyCallbackFailed = true;
+            this.#events.emit(WatchEvent.DATA_ERROR, err);
+          }
           continue;
         }
 
@@ -318,33 +342,54 @@ export class Watcher<T extends GenericClass> {
         // Check if the resource version is newer than the cached version
         if (itemRV > cachedRV) {
           this.#events.emit(WatchEvent.CACHE_MISS, this.#latestRelistWindow);
-          // Send a modified event if the resource version has changed
-          void this.#process(item, WatchPhase.Modified);
+          try {
+            this.#lastSeenTime = Date.now();
+            await this.#process(item, WatchPhase.Modified);
+          } catch (err) {
+            anyCallbackFailed = true;
+            this.#events.emit(WatchEvent.DATA_ERROR, err);
+          }
         }
       }
 
       // If there is a continue token, call the list function again with the same removed items
       if (continueToken) {
         // Safeguard against infinite pagination
-        if (retryCount >= maxPages) {
+        if (pageCount >= maxPages) {
           this.#events.emit(
             WatchEvent.LIST_ERROR,
             new Error(`Maximum pagination limit (${maxPages}) reached, stopping list operation`),
           );
-          return;
+          return false;
         }
 
-        // Continue pagination (not a retry, so reset retryCount to 0)
-        await this.#list(continueToken, removedItems, 0);
+        // Continue pagination (not a retry, so reset retryCount to 0).
+        // Combine with current page's failure state so a callback failure on
+        // an earlier page is not masked by a successful later page.
+        const nextPageSucceeded = await this.#list(continueToken, removedItems, 0, pageCount + 1);
+        return !anyCallbackFailed && nextPageSucceeded;
       } else {
         // Otherwise, process the removed items
         for (const item of removedItems.values()) {
           this.#events.emit(WatchEvent.CACHE_MISS, this.#latestRelistWindow);
-          void this.#process(item, WatchPhase.Deleted);
+          try {
+            this.#lastSeenTime = Date.now();
+            await this.#process(item, WatchPhase.Deleted);
+          } catch (err) {
+            anyCallbackFailed = true;
+            this.#events.emit(WatchEvent.DATA_ERROR, err);
+          }
         }
       }
+
+      return !anyCallbackFailed;
     } catch (err) {
       this.#events.emit(WatchEvent.LIST_ERROR, err);
+      return false;
+    } finally {
+      if (isTopLevel) {
+        this.#listInProgress = false;
+      }
     }
   };
 
@@ -355,28 +400,24 @@ export class Watcher<T extends GenericClass> {
    * @param phase - the event phase
    */
   #process = async (payload: InstanceType<T>, phase: WatchPhase) => {
-    try {
-      switch (phase) {
-        // If the event is added or modified, update the cache
-        case WatchPhase.Added:
-        case WatchPhase.Modified:
-          this.#cache.set(payload.metadata.uid, payload);
-          break;
-
-        // If the event is deleted, remove the item from the cache
-        case WatchPhase.Deleted:
-          this.#cache.delete(payload.metadata.uid);
-          break;
-      }
-
-      // Emit the data event
-      this.#events.emit(WatchEvent.DATA, payload, phase);
+    // Call the callback function — if it throws, the cache is NOT updated
+    // so the next relist will detect the item as unprocessed and retry
+    await this.#callback(payload, phase);
+
+    // Only update cache after the callback succeeds
+    switch (phase) {
+      case WatchPhase.Added:
+      case WatchPhase.Modified:
+        this.#cache.set(payload.metadata.uid, payload);
+        break;
 
-      // Call the callback function with the parsed payload
-      await this.#callback(payload, phase);
-    } catch (err) {
-      this.#events.emit(WatchEvent.DATA_ERROR, err);
+      case WatchPhase.Deleted:
+        this.#cache.delete(payload.metadata.uid);
+        break;
     }
+
+    // Emit data event only after callback succeeds and cache is updated
+    this.#events.emit(WatchEvent.DATA, payload, phase);
   };
 
   // process a line from the chunk
@@ -402,7 +443,9 @@ export class Watcher<T extends GenericClass> {
         };
       }
 
-      // Process the event payload, do not update the resource version as that is handled by the list operation
+      // Process the event payload, do not update the resource version as that is handled by the list operation.
+      // Watch-stream events are not retried on callback failure — the relist timer
+      // will re-detect unprocessed items on its next cycle.
       await process(payload, phase);
     } catch (err) {
       if (err.name === "TooOld") {
@@ -422,13 +465,19 @@ export class Watcher<T extends GenericClass> {
    */
   #watch = async (retryCount = 0): Promise<void> => {
     const maxRetries = 5;
-    // Start with a list operation, but don't let it block the watch stream
+    // Start with a list operation
+    let listSucceeded = false;
     try {
-      await this.#list();
+      listSucceeded = await this.#list();
     } catch (listError) {
       this.#events.emit(WatchEvent.LIST_ERROR, listError);
     }
 
+    // If the list failed, trigger a faster resync so items aren't permanently missed
+    if (!listSucceeded) {
+      this.#lastSeenTime = OVERRIDE;
+    }
+
     // Build the URL and request options
     try {
       const { opts, serverUrl } = await this.#buildURL(true, this.#resourceVersion);