typekro 0.28.1 → 0.30.0

package/dist/core/deployment/kro-readiness.d.ts

@@ -38,6 +38,8 @@ export interface KroReadinessOptions {
     pollInterval?: number;
     /** Optional context for error messages (e.g. factory name). */
     factoryContext?: string;
+    /** Signal for cancelling the readiness operation. */
+    abortSignal?: AbortSignal;
 }
 /**
  * Wait for a Kro custom resource instance to become ready.

package/dist/core/deployment/kro-readiness.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"kro-readiness.d.ts","sourceRoot":"","sources":["../../../src/core/deployment/kro-readiness.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,KAAK,GAAG,MAAM,yBAAyB,CAAC;AAWpD,kDAAkD;AAClD,MAAM,WAAW,mBAAmB;IAClC,6CAA6C;IAC7C,YAAY,EAAE,MAAM,CAAC;IAErB,+BAA+B;IAC/B,OAAO,EAAE,MAAM,CAAC;IAEhB,uEAAuE;IACvE,MAAM,EAAE,GAAG,CAAC,mBAAmB,CAAC;IAEhC,+DAA+D;IAC/D,gBAAgB,EAAE,GAAG,CAAC,gBAAgB,CAAC;IAEvC,yDAAyD;IACzD,SAAS,EAAE,MAAM,CAAC;IAElB,yEAAyE;IACzE,UAAU,EAAE,MAAM,CAAC;IAEnB,yDAAyD;IACzD,IAAI,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC;IAEhB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,+DAA+D;IAC/D,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,uBAAuB,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAwPzF"}
+{"version":3,"file":"kro-readiness.d.ts","sourceRoot":"","sources":["../../../src/core/deployment/kro-readiness.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,KAAK,GAAG,MAAM,yBAAyB,CAAC;AAWpD,kDAAkD;AAClD,MAAM,WAAW,mBAAmB;IAClC,6CAA6C;IAC7C,YAAY,EAAE,MAAM,CAAC;IAErB,+BAA+B;IAC/B,OAAO,EAAE,MAAM,CAAC;IAEhB,uEAAuE;IACvE,MAAM,EAAE,GAAG,CAAC,mBAAmB,CAAC;IAEhC,+DAA+D;IAC/D,gBAAgB,EAAE,GAAG,CAAC,gBAAgB,CAAC;IAEvC,yDAAyD;IACzD,SAAS,EAAE,MAAM,CAAC;IAElB,yEAAyE;IACzE,UAAU,EAAE,MAAM,CAAC;IAEnB,yDAAyD;IACzD,IAAI,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC;IAEhB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,+DAA+D;IAC/D,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,qDAAqD;IACrD,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAkBD;;;;;;;;;;;GAWG;AACH,wBAAsB,uBAAuB,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAkQzF"}

package/dist/core/deployment/kro-readiness.js

@@ -12,7 +12,23 @@
 import { DEFAULT_FAST_POLL_INTERVAL, DEFAULT_HTTP_READ_TIMEOUT, DEFAULT_POLL_INTERVAL, } from '../config/defaults.js';
 import { CRDInstanceError, DeploymentTimeoutError, ensureError } from '../errors.js';
 import { getComponentLogger } from '../logging/index.js';
-import { callWithTimeout, perCallTimeout, PollTimeoutError } from './poll-timeout.js';
+import { callWithTimeout, PollTimeoutError, perCallTimeout } from './poll-timeout.js';
+function abortableDelay(ms, abortSignal) {
+    abortSignal?.throwIfAborted();
+    if (!abortSignal)
+        return new Promise((resolve) => setTimeout(resolve, ms));
+    return new Promise((resolve, reject) => {
+        const onAbort = () => {
+            clearTimeout(timeout);
+            reject(abortSignal.reason ?? new DOMException('The operation was aborted', 'AbortError'));
+        };
+        const timeout = setTimeout(() => {
+            abortSignal.removeEventListener('abort', onAbort);
+            resolve();
+        }, ms);
+        abortSignal.addEventListener('abort', onAbort, { once: true });
+    });
+}
 /**
  * Wait for a Kro custom resource instance to become ready.
  *
@@ -26,11 +42,12 @@ import { callWithTimeout, perCallTimeout, PollTimeoutError } from './poll-timeou
  * @throws {DeploymentTimeoutError} if the timeout is exceeded
  */
 export async function waitForKroInstanceReady(options) {
-    const { instanceName, timeout, k8sApi, customObjectsApi, namespace, apiVersion, kind, rgdName, pollInterval = DEFAULT_FAST_POLL_INTERVAL, factoryContext, } = options;
+    const { instanceName, timeout, k8sApi, customObjectsApi, namespace, apiVersion, kind, rgdName, pollInterval = DEFAULT_FAST_POLL_INTERVAL, factoryContext, abortSignal, } = options;
     const logger = getComponentLogger('kro-readiness');
     const readinessLogger = logger.child({ instanceName, rgdName });
     const startTime = Date.now();
     while (Date.now() - startTime < timeout) {
+        abortSignal?.throwIfAborted();
         try {
             // Bound the read so a wedged/expired kubeconfig exec credential rejects (and is re-thrown below)
             // instead of hanging the poll forever — see poll-timeout.ts. A ≤0 budget means the deadline is
@@ -45,14 +62,14 @@ export async function waitForKroInstanceReady(options) {
                     name: instanceName,
                     namespace,
                 },
-            }), readTimeout, `read ${kind}/${instanceName}`);
+            }), readTimeout, `read ${kind}/${instanceName}`, abortSignal);
             // In the new API, methods return objects directly (no .body wrapper)
             const instance = response;
             // Kro-specific readiness logic
             const status = instance.status;
             if (!status) {
                 readinessLogger.debug('No status found yet, continuing to wait', { instanceName });
-                await new Promise((resolve) => setTimeout(resolve, DEFAULT_POLL_INTERVAL));
+                await abortableDelay(DEFAULT_POLL_INTERVAL, abortSignal);
                 continue;
             }
             const state = status.state;
@@ -85,7 +102,7 @@ export async function waitForKroInstanceReady(options) {
                     version: 'v1alpha1',
                     plural: 'resourcegraphdefinitions',
                     name: rgdName,
-                }), rgdReadTimeout, `read ResourceGraphDefinition/${rgdName}`);
+                }), rgdReadTimeout, `read ResourceGraphDefinition/${rgdName}`, abortSignal);
                 const rgd = rgdResponse;
                 const rgdStatusSchema = rgd.spec?.schema?.status ?? {};
                 expectedStatusKeys = Object.keys(rgdStatusSchema).filter((key) => !basicKroFields.includes(key));
@@ -196,7 +213,7 @@ export async function waitForKroInstanceReady(options) {
             readinessLogger.debug('Instance not found yet, continuing to wait', { instanceName });
         }
         // Wait before checking again
-        await new Promise((resolve) => setTimeout(resolve, pollInterval));
+        await abortableDelay(pollInterval, abortSignal);
     }
     const elapsed = Date.now() - startTime;
     throw new DeploymentTimeoutError(`Timeout waiting for Kro instance ${instanceName} to be ready after ${elapsed}ms (timeout: ${timeout}ms).${factoryContext ? ` This usually means the Kro controller is not running or the RGD deployment failed. Check Kro controller logs: kubectl logs -n kro-system deployment/kro` : ''}`, kind, instanceName, timeout, 'instance-readiness');

package/dist/core/deployment/kro-readiness.js.map

@@ -1 +1 @@
-{"version":3,"file":"kro-readiness.js","sourceRoot":"","sources":["../../../src/core/deployment/kro-readiness.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,EACzB,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACrF,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAyCtF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,OAA4B;IACxE,MAAM,EACJ,YAAY,EACZ,OAAO,EACP,MAAM,EACN,gBAAgB,EAChB,SAAS,EACT,UAAU,EACV,IAAI,EACJ,OAAO,EACP,YAAY,GAAG,0BAA0B,EACzC,cAAc,GACf,GAAG,OAAO,CAAC;IAEZ,MAAM,MAAM,GAAG,kBAAkB,CAAC,eAAe,CAAC,CAAC;IACnD,MAAM,eAAe,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;IAChE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,OAAO,EAAE,CAAC;QACxC,IAAI,CAAC;YACH,iGAAiG;YACjG,+FAA+F;YAC/F,8FAA8F;YAC9F,MAAM,WAAW,GAAG,cAAc,CAAC,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,EAAE,yBAAyB,CAAC,CAAC;YAClG,IAAI,WAAW,IAAI,CAAC;gBAAE,MAAM;YAC5B,MAAM,QAAQ,GAAG,MAAM,eAAe,CACpC,GAAG,EAAE,CACH,MAAM,CAAC,IAAI,CAAC;gBACV,UAAU;gBACV,IAAI;gBACJ,QAAQ,EAAE;oBACR,IAAI,EAAE,YAAY;oBAClB,SAAS;iBACV;aACF,CAAC,EACJ,WAAW,EACX,QAAQ,IAAI,IAAI,YAAY,EAAE,CAC/B,CAAC;YAEF,qEAAqE;YACrE,MAAM,QAAQ,GAAG,QAehB,CAAC;YAEF,+BAA+B;YAC/B,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;YAC/B,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,eAAe,CAAC,KAAK,CAAC,yCAAyC,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;gBACnF,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC,CAAC;gBAC3E,SAAS;YACX,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;YAC3B,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;YAC3C,yEAAyE;YACzE,MAAM,eAAe,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,gBAAgB,CAAC,CAAC;YAC5E,MAAM,cAAc,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;YAClE,MAAM,UAAU,GAAG,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;YACjD,MAAM,kBAAkB,GAAG,CAAC,SAAkD,EAAE,EAAE,CAChF,SAAS,EAAE,MAAM,KAAK,MAAM;gBAC5B,CAAC,UAAU,KAAK,SAAS;oBACvB,SAAS,CAAC,kBAAkB,KAAK,SAAS;oBAC1C,SAAS,CAAC,kBAAkB,IAAI,UAAU,CAAC,CAAC;YAEhD,6EAA6E;YAC7E,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACvC,MAAM,cAAc,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;YAC/C,MAAM,qBAAqB,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YAEtF,MAAM,QAAQ,GAAG,KAAK,KAAK,QAAQ,CAAC;YACpC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,eAAe,CAAC,IAAI,kBAAkB,CAAC,cAAc,CAAC,CAAC;YAE3F,kFAAkF;YAClF,IAAI,0BAA0B,GAAG,KAAK,CAAC;YACvC,IAAI,kBAAkB,GAAa,EAAE,CAAC;YACtC,IAAI,CAAC;gBACH,MAAM,cAAc,GAAG,cAAc,CAAC,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,EAAE,yBAAyB,CAAC,CAAC;gBACrG,iGAAiG;gBACjG,8EAA8E;gBAC9E,IAAI,cAAc,IAAI,CAAC;oBAAE,MAAM;gBAC/B,MAAM,WAAW,GAAG,MAAM,eAAe,CACvC,GAAG,EAAE,CACH,gBAAgB,CAAC,sBAAsB,CAAC;oBACtC,KAAK,EAAE,SAAS;oBAChB,OAAO,EAAE,UAAU;oBACnB,MAAM,EAAE,0BAA0B;oBAClC,IAAI,EAAE,OAAO;iBACd,CAAC,EACJ,cAAc,EACd,gCAAgC,OAAO,EAAE,CAC1C,CAAC;gBACF,MAAM,GAAG,GAAG,WAA0B,CAAC;gBACvC,MAAM,eAAe,GAAG,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,IAAI,EAAE,CAAC;gBACvD,kBAAkB,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,MAAM,CACtD,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,CACvC,CAAC;gBACF,0BAA0B,GAAG,kBAAkB,CAAC,MAAM,GAAG,CAAC,CAAC;gBAE3D,eAAe,CAAC,KAAK,CAAC,6CAA6C,EAAE;oBACnE,OAAO;oBACP,aAAa,EAAE,kBAAkB;oBACjC,0BAA0B;iBAC3B,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAc,EAAE,CAAC;gBACxB,8FAA8F;gBAC9F,8FAA8F;gBAC9F,8FAA8F;gBAC9F,kCAAkC;gBAClC,IAAI,KAAK,YAAY,gBAAgB,EAAE,CAAC;oBACtC,MAAM,KAAK,CAAC;gBACd,CAAC;gBACD,eAAe,CAAC,IAAI,CAAC,iEAAiE,EAAE;oBACtF,OAAO;oBACP,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,OAAO;iBAClC,CAAC,CAAC;gBACH,gGAAgG;gBAChG,0BAA0B,GAAG,KAAK,CAAC;YACrC,CAAC;YAED,eAAe,CAAC,KAAK,CAAC,2BAA2B,EAAE;gBACjD,YAAY;gBACZ,KAAK;gBACL,QAAQ;gBACR,QAAQ;gBACR,qBAAqB;gBACrB,0BAA0B;gBAC1B,kBAAkB;gBAClB,UAAU;gBACV,UAAU;gBACV,wBAAwB,EAAE,eAAe,EAAE,kBAAkB;gBAC7D,uBAAuB,EAAE,cAAc,EAAE,kBAAkB;aAC5D,CAAC,CAAC;YAEH,2EAA2E;YAC3E,4EAA4E;YAC5E,wDAAwD;YACxD,MAAM,gBAAgB,GAAG,MAAM,CAAC,KAAK,CAAC;YACtC,MAAM,aAAa,GAAG,OAAO,gBAAgB,KAAK,SAAS,CAAC;YAC5D,MAAM,uBAAuB,GAC3B,kBAAkB,CAAC,MAAM,KAAK,CAAC;gBAC/B,kBAAkB,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;YAChE,oEAAoE;YACpE,0EAA0E;YAC1E,sEAAsE;YACtE,qEAAqE;YACrE,2DAA2D;YAC3D,MAAM,2BAA2B,GAAG,MAAM,CAAC,kBAAkB,CAAC;YAC9D,MAAM,wBAAwB,GAC5B,2BAA2B,KAAK,SAAS;gBACzC,UAAU,KAAK,SAAS;gBACxB,2BAA2B,IAAI,UAAU,CAAC;YAC5C,MAAM,OAAO,GACX,QAAQ;gBACR,QAAQ;gBACR,uBAAuB;gBACvB,wBAAwB;gBACxB,CAAC,CAAC,aAAa,IAAI,gBAAgB,KAAK,IAAI,CAAC,CAAC;YAEhD,IAAI,OAAO,EAAE,CAAC;gBACZ,+FAA+F;gBAC/F,+FAA+F;gBAC/F,yCAAyC;gBACzC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,IAAI,OAAO,EAAE,CAAC;oBACtC,MAAM;gBACR,CAAC;gBACD,eAAe,CAAC,IAAI,CAAC,uBAAuB,EAAE;oBAC5C,YAAY;oBACZ,qBAAqB;oBACrB,0BAA0B;oBAC1B,kBAAkB;iBACnB,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,2EAA2E;YAC3E,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;gBAC5C,MAAM,eAAe,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC;gBACrE,MAAM,YAAY,GAAG,eAAe,EAAE,OAAO,IAAI,eAAe,CAAC;gBACjE,MAAM,IAAI,gBAAgB,CACxB,yCAAyC,KAAK,MAAM,YAAY,EAAE,EAClE,UAAU,EACV,IAAI,EACJ,YAAY,EACZ,UAAU,CACX,CAAC;YACJ,CAAC;YAED,eAAe,CAAC,KAAK,CAAC,gDAAgD,EAAE;gBACtE,YAAY;gBACZ,KAAK;gBACL,QAAQ;gBACR,qBAAqB;gBACrB,kBAAkB;gBAClB,2BAA2B;gBAC3B,wBAAwB;aACzB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,kCAAkC;YAClC,IAAI,KAAK,YAAY,gBAAgB,EAAE,CAAC;gBACtC,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,QAAQ,GAAG,KAKhB,CAAC;YACF,MAAM,SAAS,GACb,QAAQ,CAAC,UAAU;gBACnB,QAAQ,CAAC,IAAI,EAAE,IAAI;gBACnB,CAAC,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAClE,MAAM,UAAU,GACd,SAAS,KAAK,GAAG;gBACjB,QAAQ,CAAC,IAAI,EAAE,MAAM,KAAK,UAAU;gBACpC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,YAAY,CAAC,KAAK,IAAI;gBACjD,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC;YAClD,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,KAAK,CAAC;YACd,CAAC;YACD,2CAA2C;YAC3C,eAAe,CAAC,KAAK,CAAC,4CAA4C,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;QACxF,CAAC;QAED,6BAA6B;QAC7B,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IACvC,MAAM,IAAI,sBAAsB,CAC9B,oCAAoC,YAAY,sBAAsB,OAAO,gBAAgB,OAAO,OAAO,cAAc,CAAC,CAAC,CAAC,0JAA0J,CAAC,CAAC,CAAC,EAAE,EAAE,EAC7R,IAAI,EACJ,YAAY,EACZ,OAAO,EACP,oBAAoB,CACrB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"kro-readiness.js","sourceRoot":"","sources":["../../../src/core/deployment/kro-readiness.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,EACzB,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACrF,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AA4CtF,SAAS,cAAc,CAAC,EAAU,EAAE,WAAyB;IAC3D,WAAW,EAAE,cAAc,EAAE,CAAC;IAC9B,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IAC3E,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,OAAO,GAAG,GAAG,EAAE;YACnB,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,MAAM,CAAC,WAAW,CAAC,MAAM,IAAI,IAAI,YAAY,CAAC,2BAA2B,EAAE,YAAY,CAAC,CAAC,CAAC;QAC5F,CAAC,CAAC;QACF,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;YAC9B,WAAW,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAClD,OAAO,EAAE,CAAC;QACZ,CAAC,EAAE,EAAE,CAAC,CAAC;QACP,WAAW,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,OAA4B;IACxE,MAAM,EACJ,YAAY,EACZ,OAAO,EACP,MAAM,EACN,gBAAgB,EAChB,SAAS,EACT,UAAU,EACV,IAAI,EACJ,OAAO,EACP,YAAY,GAAG,0BAA0B,EACzC,cAAc,EACd,WAAW,GACZ,GAAG,OAAO,CAAC;IAEZ,MAAM,MAAM,GAAG,kBAAkB,CAAC,eAAe,CAAC,CAAC;IACnD,MAAM,eAAe,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;IAChE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,OAAO,EAAE,CAAC;QACxC,WAAW,EAAE,cAAc,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,iGAAiG;YACjG,+FAA+F;YAC/F,8FAA8F;YAC9F,MAAM,WAAW,GAAG,cAAc,CAChC,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,EAClC,yBAAyB,CAC1B,CAAC;YACF,IAAI,WAAW,IAAI,CAAC;gBAAE,MAAM;YAC5B,MAAM,QAAQ,GAAG,MAAM,eAAe,CACpC,GAAG,EAAE,CACH,MAAM,CAAC,IAAI,CAAC;gBACV,UAAU;gBACV,IAAI;gBACJ,QAAQ,EAAE;oBACR,IAAI,EAAE,YAAY;oBAClB,SAAS;iBACV;aACF,CAAC,EACJ,WAAW,EACX,QAAQ,IAAI,IAAI,YAAY,EAAE,EAC9B,WAAW,CACZ,CAAC;YAEF,qEAAqE;YACrE,MAAM,QAAQ,GAAG,QAehB,CAAC;YAEF,+BAA+B;YAC/B,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;YAC/B,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,eAAe,CAAC,KAAK,CAAC,yCAAyC,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;gBACnF,MAAM,cAAc,CAAC,qBAAqB,EAAE,WAAW,CAAC,CAAC;gBACzD,SAAS;YACX,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;YAC3B,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;YAC3C,yEAAyE;YACzE,MAAM,eAAe,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,gBAAgB,CAAC,CAAC;YAC5E,MAAM,cAAc,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;YAClE,MAAM,UAAU,GAAG,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;YACjD,MAAM,kBAAkB,GAAG,CAAC,SAAkD,EAAE,EAAE,CAChF,SAAS,EAAE,MAAM,KAAK,MAAM;gBAC5B,CAAC,UAAU,KAAK,SAAS;oBACvB,SAAS,CAAC,kBAAkB,KAAK,SAAS;oBAC1C,SAAS,CAAC,kBAAkB,IAAI,UAAU,CAAC,CAAC;YAEhD,6EAA6E;YAC7E,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACvC,MAAM,cAAc,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;YAC/C,MAAM,qBAAqB,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YAEtF,MAAM,QAAQ,GAAG,KAAK,KAAK,QAAQ,CAAC;YACpC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,eAAe,CAAC,IAAI,kBAAkB,CAAC,cAAc,CAAC,CAAC;YAE3F,kFAAkF;YAClF,IAAI,0BAA0B,GAAG,KAAK,CAAC;YACvC,IAAI,kBAAkB,GAAa,EAAE,CAAC;YACtC,IAAI,CAAC;gBACH,MAAM,cAAc,GAAG,cAAc,CACnC,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,EAClC,yBAAyB,CAC1B,CAAC;gBACF,iGAAiG;gBACjG,8EAA8E;gBAC9E,IAAI,cAAc,IAAI,CAAC;oBAAE,MAAM;gBAC/B,MAAM,WAAW,GAAG,MAAM,eAAe,CACvC,GAAG,EAAE,CACH,gBAAgB,CAAC,sBAAsB,CAAC;oBACtC,KAAK,EAAE,SAAS;oBAChB,OAAO,EAAE,UAAU;oBACnB,MAAM,EAAE,0BAA0B;oBAClC,IAAI,EAAE,OAAO;iBACd,CAAC,EACJ,cAAc,EACd,gCAAgC,OAAO,EAAE,EACzC,WAAW,CACZ,CAAC;gBACF,MAAM,GAAG,GAAG,WAA0B,CAAC;gBACvC,MAAM,eAAe,GAAG,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,IAAI,EAAE,CAAC;gBACvD,kBAAkB,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,MAAM,CACtD,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,CACvC,CAAC;gBACF,0BAA0B,GAAG,kBAAkB,CAAC,MAAM,GAAG,CAAC,CAAC;gBAE3D,eAAe,CAAC,KAAK,CAAC,6CAA6C,EAAE;oBACnE,OAAO;oBACP,aAAa,EAAE,kBAAkB;oBACjC,0BAA0B;iBAC3B,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAc,EAAE,CAAC;gBACxB,8FAA8F;gBAC9F,8FAA8F;gBAC9F,8FAA8F;gBAC9F,kCAAkC;gBAClC,IAAI,KAAK,YAAY,gBAAgB,EAAE,CAAC;oBACtC,MAAM,KAAK,CAAC;gBACd,CAAC;gBACD,eAAe,CAAC,IAAI,CAAC,iEAAiE,EAAE;oBACtF,OAAO;oBACP,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,OAAO;iBAClC,CAAC,CAAC;gBACH,gGAAgG;gBAChG,0BAA0B,GAAG,KAAK,CAAC;YACrC,CAAC;YAED,eAAe,CAAC,KAAK,CAAC,2BAA2B,EAAE;gBACjD,YAAY;gBACZ,KAAK;gBACL,QAAQ;gBACR,QAAQ;gBACR,qBAAqB;gBACrB,0BAA0B;gBAC1B,kBAAkB;gBAClB,UAAU;gBACV,UAAU;gBACV,wBAAwB,EAAE,eAAe,EAAE,kBAAkB;gBAC7D,uBAAuB,EAAE,cAAc,EAAE,kBAAkB;aAC5D,CAAC,CAAC;YAEH,2EAA2E;YAC3E,4EAA4E;YAC5E,wDAAwD;YACxD,MAAM,gBAAgB,GAAG,MAAM,CAAC,KAAK,CAAC;YACtC,MAAM,aAAa,GAAG,OAAO,gBAAgB,KAAK,SAAS,CAAC;YAC5D,MAAM,uBAAuB,GAC3B,kBAAkB,CAAC,MAAM,KAAK,CAAC;gBAC/B,kBAAkB,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;YAChE,oEAAoE;YACpE,0EAA0E;YAC1E,sEAAsE;YACtE,qEAAqE;YACrE,2DAA2D;YAC3D,MAAM,2BAA2B,GAAG,MAAM,CAAC,kBAAkB,CAAC;YAC9D,MAAM,wBAAwB,GAC5B,2BAA2B,KAAK,SAAS;gBACzC,UAAU,KAAK,SAAS;gBACxB,2BAA2B,IAAI,UAAU,CAAC;YAC5C,MAAM,OAAO,GACX,QAAQ;gBACR,QAAQ;gBACR,uBAAuB;gBACvB,wBAAwB;gBACxB,CAAC,CAAC,aAAa,IAAI,gBAAgB,KAAK,IAAI,CAAC,CAAC;YAEhD,IAAI,OAAO,EAAE,CAAC;gBACZ,+FAA+F;gBAC/F,+FAA+F;gBAC/F,yCAAyC;gBACzC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,IAAI,OAAO,EAAE,CAAC;oBACtC,MAAM;gBACR,CAAC;gBACD,eAAe,CAAC,IAAI,CAAC,uBAAuB,EAAE;oBAC5C,YAAY;oBACZ,qBAAqB;oBACrB,0BAA0B;oBAC1B,kBAAkB;iBACnB,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,2EAA2E;YAC3E,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;gBAC5C,MAAM,eAAe,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC;gBACrE,MAAM,YAAY,GAAG,eAAe,EAAE,OAAO,IAAI,eAAe,CAAC;gBACjE,MAAM,IAAI,gBAAgB,CACxB,yCAAyC,KAAK,MAAM,YAAY,EAAE,EAClE,UAAU,EACV,IAAI,EACJ,YAAY,EACZ,UAAU,CACX,CAAC;YACJ,CAAC;YAED,eAAe,CAAC,KAAK,CAAC,gDAAgD,EAAE;gBACtE,YAAY;gBACZ,KAAK;gBACL,QAAQ;gBACR,qBAAqB;gBACrB,kBAAkB;gBAClB,2BAA2B;gBAC3B,wBAAwB;aACzB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,kCAAkC;YAClC,IAAI,KAAK,YAAY,gBAAgB,EAAE,CAAC;gBACtC,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,QAAQ,GAAG,KAKhB,CAAC;YACF,MAAM,SAAS,GACb,QAAQ,CAAC,UAAU;gBACnB,QAAQ,CAAC,IAAI,EAAE,IAAI;gBACnB,CAAC,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAClE,MAAM,UAAU,GACd,SAAS,KAAK,GAAG;gBACjB,QAAQ,CAAC,IAAI,EAAE,MAAM,KAAK,UAAU;gBACpC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,YAAY,CAAC,KAAK,IAAI;gBACjD,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC;YAClD,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,KAAK,CAAC;YACd,CAAC;YACD,2CAA2C;YAC3C,eAAe,CAAC,KAAK,CAAC,4CAA4C,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;QACxF,CAAC;QAED,6BAA6B;QAC7B,MAAM,cAAc,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IACvC,MAAM,IAAI,sBAAsB,CAC9B,oCAAoC,YAAY,sBAAsB,OAAO,gBAAgB,OAAO,OAAO,cAAc,CAAC,CAAC,CAAC,0JAA0J,CAAC,CAAC,CAAC,EAAE,EAAE,EAC7R,IAAI,EACJ,YAAY,EACZ,OAAO,EACP,oBAAoB,CACrB,CAAC;AACJ,CAAC"}

package/dist/core/deployment/poll-timeout.d.ts

@@ -33,7 +33,7 @@ export declare class PollTimeoutError extends Error {
  * means "an operation that actually started did not return in time" (a wedged call), never "the overall
  * poll deadline had already elapsed" — the two are distinct and must not be conflated.
  */
-export declare function callWithTimeout<T>(op: () => Promise<T>, timeoutMs: number, label: string): Promise<T>;
+export declare function callWithTimeout<T>(op: () => Promise<T>, timeoutMs: number, label: string, abortSignal?: AbortSignal): Promise<T>;
 /**
  * The per-call budget: the configured cap (HTTP read timeout), capped STRICTLY by the poll's remaining
  * deadline so one call can never overshoot the overall `timeout`. Returns ≤ 0 when the deadline is

package/dist/core/deployment/poll-timeout.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"poll-timeout.d.ts","sourceRoot":"","sources":["../../../src/core/deployment/poll-timeout.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,8HAA8H;AAC9H,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;gBACf,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM;CAS7C;AAED;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAY3G;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEzE"}
+{"version":3,"file":"poll-timeout.d.ts","sourceRoot":"","sources":["../../../src/core/deployment/poll-timeout.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,8HAA8H;AAC9H,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;gBACf,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM;CAS7C;AAED;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CAAC,CAAC,EACrC,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EACpB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,WAAW,CAAC,EAAE,WAAW,GACxB,OAAO,CAAC,CAAC,CAAC,CAuBZ;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEzE"}

package/dist/core/deployment/poll-timeout.js

@@ -39,19 +39,30 @@ export class PollTimeoutError extends Error {
  * means "an operation that actually started did not return in time" (a wedged call), never "the overall
  * poll deadline had already elapsed" — the two are distinct and must not be conflated.
  */
-export async function callWithTimeout(op, timeoutMs, label) {
+export async function callWithTimeout(op, timeoutMs, label, abortSignal) {
     let timer;
+    let detachAbort = () => undefined;
     try {
+        abortSignal?.throwIfAborted();
+        const aborted = new Promise((_, reject) => {
+            if (!abortSignal)
+                return;
+            const onAbort = () => reject(abortSignal.reason ?? new DOMException('The operation was aborted', 'AbortError'));
+            abortSignal.addEventListener('abort', onAbort, { once: true });
+            detachAbort = () => abortSignal.removeEventListener('abort', onAbort);
+        });
         return await Promise.race([
             op(),
             new Promise((_, reject) => {
                 timer = setTimeout(() => reject(new PollTimeoutError(label, timeoutMs)), timeoutMs);
             }),
+            aborted,
         ]);
     }
     finally {
         if (timer)
             clearTimeout(timer);
+        detachAbort();
     }
 }
 /**

package/dist/core/deployment/poll-timeout.js.map

@@ -1 +1 @@
-{"version":3,"file":"poll-timeout.js","sourceRoot":"","sources":["../../../src/core/deployment/poll-timeout.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,8HAA8H;AAC9H,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAChC,SAAS,CAAS;IAC3B,YAAY,KAAa,EAAE,SAAiB;QAC1C,KAAK,CACH,GAAG,KAAK,iBAAiB,SAAS,+DAA+D;YAC/F,+FAA+F;YAC/F,0DAA0D,CAC7D,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAI,EAAoB,EAAE,SAAiB,EAAE,KAAa;IAC7F,IAAI,KAAgD,CAAC;IACrD,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC;YACxB,EAAE,EAAE;YACJ,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;gBAC/B,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,gBAAgB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;YACtF,CAAC,CAAC;SACH,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,WAAmB,EAAE,KAAa;IAC/D,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;AACtC,CAAC"}
+{"version":3,"file":"poll-timeout.js","sourceRoot":"","sources":["../../../src/core/deployment/poll-timeout.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,8HAA8H;AAC9H,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAChC,SAAS,CAAS;IAC3B,YAAY,KAAa,EAAE,SAAiB;QAC1C,KAAK,CACH,GAAG,KAAK,iBAAiB,SAAS,+DAA+D;YAC/F,+FAA+F;YAC/F,0DAA0D,CAC7D,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,EAAoB,EACpB,SAAiB,EACjB,KAAa,EACb,WAAyB;IAEzB,IAAI,KAAgD,CAAC;IACrD,IAAI,WAAW,GAAG,GAAS,EAAE,CAAC,SAAS,CAAC;IACxC,IAAI,CAAC;QACH,WAAW,EAAE,cAAc,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;YAC/C,IAAI,CAAC,WAAW;gBAAE,OAAO;YACzB,MAAM,OAAO,GAAG,GAAG,EAAE,CACnB,MAAM,CAAC,WAAW,CAAC,MAAM,IAAI,IAAI,YAAY,CAAC,2BAA2B,EAAE,YAAY,CAAC,CAAC,CAAC;YAC5F,WAAW,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/D,WAAW,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxE,CAAC,CAAC,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC;YACxB,EAAE,EAAE;YACJ,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;gBAC/B,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,gBAAgB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;YACtF,CAAC,CAAC;YACF,OAAO;SACR,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QAC/B,WAAW,EAAE,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,WAAmB,EAAE,KAAa;IAC/D,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;AACtC,CAAC"}

package/dist/core/deployment/resource-applier.d.ts

@@ -10,14 +10,22 @@
  */
 import type * as k8s from '@kubernetes/client-node';
 import type { TypeKroLogger } from '../logging/index.js';
+import type { ArtifactApplyPolicy } from '../planning/artifacts.js';
 import type { ReferenceResolver } from '../references/index.js';
 import type { DeploymentOptions, ResolutionContext } from '../types/deployment.js';
 import type { DeployableK8sResource, Enhanced, KubernetesResource } from '../types.js';
-export declare class ResourceApplier {
+/** Host-neutral contract for applying one compiled Kubernetes artifact operation. */
+export interface ArtifactResourceApplier {
+    applyArtifactResource(resource: KubernetesResource, policy: ArtifactApplyPolicy | undefined, options: DeploymentOptions, resourceLogger: TypeKroLogger): Promise<k8s.KubernetesObject>;
+}
+export declare class ResourceApplier implements ArtifactResourceApplier {
     private k8sApi;
     private referenceResolver;
-    constructor(k8sApi: k8s.KubernetesObjectApi, referenceResolver: ReferenceResolver, _logger: TypeKroLogger);
+    constructor(k8sApi: k8s.KubernetesObjectApi, referenceResolver: ReferenceResolver | undefined, _logger: TypeKroLogger);
     private buildResourceIdentityMetadata;
+    private throwIfAborted;
+    private abortableDelay;
+    private isImmutableFieldError;
     /**
      * Serialize a resource for sending to the Kubernetes API.
      * Calls toJSON() if available (to preserve arrays via custom implementation),
@@ -55,12 +63,20 @@ export declare class ResourceApplier {
      * Handle a 409 Conflict error based on the configured conflict strategy.
      * Returns the applied resource if the conflict was handled, or undefined if it wasn't.
      */
-    handleConflictStrategy(resolvedResource: KubernetesResource, conflictStrategy: NonNullable<DeploymentOptions['conflictStrategy']>, resourceLogger: TypeKroLogger): Promise<k8s.KubernetesObject | undefined>;
+    handleConflictStrategy(resolvedResource: KubernetesResource, conflictStrategy: NonNullable<DeploymentOptions['conflictStrategy']>, resourceLogger: TypeKroLogger, abortSignal?: AbortSignal, timeout?: number): Promise<k8s.KubernetesObject | undefined>;
+    private createResource;
+    private patchResource;
+    private replaceResource;
+    private waitForResourceDeletion;
+    private serverSideApply;
+    private applyWithPolicy;
     /**
      * Apply a resource to the Kubernetes cluster with retry logic, conflict handling,
      * and support for both create and patch operations.
      */
     applyResourceToCluster(resolvedResource: KubernetesResource, options: DeploymentOptions, resourceLogger: TypeKroLogger): Promise<k8s.KubernetesObject>;
+    /** Apply one compiled artifact operation through the canonical policy executor. */
+    applyArtifactResource(resolvedResource: KubernetesResource, applyPolicy: ArtifactApplyPolicy | undefined, options: DeploymentOptions, resourceLogger: TypeKroLogger): Promise<k8s.KubernetesObject>;
     /**
      * Check if a resource already exists in the cluster.
      * Returns the existing resource if found, or undefined if it doesn't exist (404).

package/dist/core/deployment/resource-applier.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resource-applier.d.ts","sourceRoot":"","sources":["../../../src/core/deployment/resource-applier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,KAAK,GAAG,MAAM,yBAAyB,CAAC;AAUpD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAMzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AACnF,OAAO,KAAK,EACV,qBAAqB,EACrB,QAAQ,EAER,kBAAkB,EACnB,MAAM,aAAa,CAAC;AAarB,qBAAa,eAAe;IAExB,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,iBAAiB;gBADjB,MAAM,EAAE,GAAG,CAAC,mBAAmB,EAC/B,iBAAiB,EAAE,iBAAiB,EAC5C,OAAO,EAAE,aAAa;IAGxB,OAAO,CAAC,6BAA6B;IAWrC;;;;OAIG;IACH,uBAAuB,CACrB,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,GACzD,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAgB1B;;;OAGG;IACG,yBAAyB,CAC7B,QAAQ,EAAE,qBAAqB,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,EAC3D,OAAO,EAAE,iBAAiB,EAC1B,OAAO,EAAE,iBAAiB,EAC1B,cAAc,EAAE,aAAa,GAC5B,OAAO,CAAC,kBAAkB,CAAC;IAgD9B;;;OAGG;IACH,wBAAwB,CACtB,QAAQ,EAAE,kBAAkB,EAC5B,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,cAAc,EAAE,aAAa,GAC5B,kBAAkB;IAuCrB;;;;;;;;;;;OAWG;IACH,kBAAkB,CAChB,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,iBAAiB,EAC1B,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,iBAAiB,GACzB,IAAI;IAwBP;;OAEG;IACH,iBAAiB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IA4CxE;;;OAGG;IACG,sBAAsB,CAC1B,gBAAgB,EAAE,kBAAkB,EACpC,gBAAgB,EAAE,WAAW,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,CAAC,EACpE,cAAc,EAAE,aAAa,GAC5B,OAAO,CAAC,GAAG,CAAC,gBAAgB,GAAG,SAAS,CAAC;IAyF5C;;;OAGG;IACG,sBAAsB,CAC1B,gBAAgB,EAAE,kBAAkB,EACpC,OAAO,EAAE,iBAAiB,EAC1B,cAAc,EAAE,aAAa,GAC5B,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IA6IhC;;;;OAIG;IACG,mBAAmB,CACvB,QAAQ,EAAE,kBAAkB,EAC5B,cAAc,EAAE,aAAa,GAC5B,OAAO,CAAC,GAAG,CAAC,gBAAgB,GAAG,SAAS,CAAC;CAoC7C"}
+{"version":3,"file":"resource-applier.d.ts","sourceRoot":"","sources":["../../../src/core/deployment/resource-applier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,KAAK,GAAG,MAAM,yBAAyB,CAAC;AAUpD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAMzD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AACpE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAEhE,OAAO,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AACnF,OAAO,KAAK,EACV,qBAAqB,EACrB,QAAQ,EAER,kBAAkB,EACnB,MAAM,aAAa,CAAC;AAiBrB,qFAAqF;AACrF,MAAM,WAAW,uBAAuB;IACtC,qBAAqB,CACnB,QAAQ,EAAE,kBAAkB,EAC5B,MAAM,EAAE,mBAAmB,GAAG,SAAS,EACvC,OAAO,EAAE,iBAAiB,EAC1B,cAAc,EAAE,aAAa,GAC5B,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;CAClC;AAED,qBAAa,eAAgB,YAAW,uBAAuB;IAE3D,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,iBAAiB;gBADjB,MAAM,EAAE,GAAG,CAAC,mBAAmB,EAC/B,iBAAiB,EAAE,iBAAiB,GAAG,SAAS,EACxD,OAAO,EAAE,aAAa;IAGxB,OAAO,CAAC,6BAA6B;IAWrC,OAAO,CAAC,cAAc;YAIR,cAAc;IAqB5B,OAAO,CAAC,qBAAqB;IAS7B;;;;OAIG;IACH,uBAAuB,CACrB,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,GACzD,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAgB1B;;;OAGG;IACG,yBAAyB,CAC7B,QAAQ,EAAE,qBAAqB,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,EAC3D,OAAO,EAAE,iBAAiB,EAC1B,OAAO,EAAE,iBAAiB,EAC1B,cAAc,EAAE,aAAa,GAC5B,OAAO,CAAC,kBAAkB,CAAC;IAoD9B;;;OAGG;IACH,wBAAwB,CACtB,QAAQ,EAAE,kBAAkB,EAC5B,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,cAAc,EAAE,aAAa,GAC5B,kBAAkB;IAuCrB;;;;;;;;;;;OAWG;IACH,kBAAkB,CAChB,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,iBAAiB,EAC1B,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,iBAAiB,GACzB,IAAI;IAwBP;;OAEG;IACH,iBAAiB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IA4CxE;;;OAGG;IACG,sBAAsB,CAC1B,gBAAgB,EAAE,kBAAkB,EACpC,gBAAgB,EAAE,WAAW,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,CAAC,EACpE,cAAc,EAAE,aAAa,EAC7B,WAAW,CAAC,EAAE,WAAW,EACzB,OAAO,SAA4B,GAClC,OAAO,CAAC,GAAG,CAAC,gBAAgB,GAAG,SAAS,CAAC;YAgG9B,cAAc;YAoBd,aAAa;YAkBb,eAAe;YAoBf,uBAAuB;YAyCvB,eAAe;YA+Bf,eAAe;IAgJ7B;;;OAGG;IACG,sBAAsB,CAC1B,gBAAgB,EAAE,kBAAkB,EACpC,OAAO,EAAE,iBAAiB,EAC1B,cAAc,EAAE,aAAa,GAC5B,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAShC,mFAAmF;IAC7E,qBAAqB,CACzB,gBAAgB,EAAE,kBAAkB,EACpC,WAAW,EAAE,mBAAmB,GAAG,SAAS,EAC5C,OAAO,EAAE,iBAAiB,EAC1B,cAAc,EAAE,aAAa,GAC5B,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IA2IhC;;;;OAIG;IACG,mBAAmB,CACvB,QAAQ,EAAE,kBAAkB,EAC5B,cAAc,EAAE,aAAa,GAC5B,OAAO,CAAC,GAAG,CAAC,gBAAgB,GAAG,SAAS,CAAC;CAoC7C"}

package/dist/core/deployment/resource-applier.js

@@ -11,8 +11,9 @@
 import { DEFAULT_BACKOFF_MULTIPLIER, DEFAULT_CONFLICT_RETRY_DELAY, DEFAULT_FAST_POLL_INTERVAL, DEFAULT_MAX_RETRIES, DEFAULT_MAX_RETRY_DELAY, DEFAULT_READINESS_TIMEOUT, } from '../config/defaults.js';
 import { ensureError } from '../errors.js';
 import { copyResourceMetadata, getMetadataField, getReadinessEvaluator, } from '../metadata/index.js';
-import { ResourceConflictError, ResourceDeploymentError, UnsupportedMediaTypeError, } from './errors.js';
-import { extractAcceptedMediaTypes, isUnsupportedMediaTypeError, patchResourceWithCorrectContentType, } from './k8s-helpers.js';
+import { compareKubernetesResources, formatCanonicalDrift } from '../resources/live-comparison.js';
+import { ResourceConflictError, ResourceDeploymentError, ResourceReplacementTimeoutError, ServerSideApplyConflictError, UnsupportedMediaTypeError, } from './errors.js';
+import { extractAcceptedMediaTypes, isConflictError, isNotFoundError, isUnsupportedMediaTypeError, patchResourceWithCorrectContentType, } from './k8s-helpers.js';
 import { applyTypekroTags, getEffectiveScopes } from './resource-tagging.js';
 export class ResourceApplier {
     k8sApi;
@@ -28,6 +29,36 @@ export class ResourceApplier {
         }
         return { name, namespace: resource.metadata?.namespace || 'default' };
     }
+    throwIfAborted(signal) {
+        signal?.throwIfAborted();
+    }
+    async abortableDelay(delay, signal) {
+        this.throwIfAborted(signal);
+        if (!signal) {
+            await new Promise((resolve) => setTimeout(resolve, delay));
+            return;
+        }
+        await new Promise((resolve, reject) => {
+            const timeout = setTimeout(() => {
+                signal.removeEventListener('abort', onAbort);
+                resolve();
+            }, delay);
+            const onAbort = () => {
+                clearTimeout(timeout);
+                signal.removeEventListener('abort', onAbort);
+                reject(signal.reason ?? new DOMException('The operation was aborted', 'AbortError'));
+            };
+            signal.addEventListener('abort', onAbort, { once: true });
+        });
+    }
+    isImmutableFieldError(error) {
+        const apiError = error;
+        const statusCode = apiError.statusCode ?? apiError.response?.statusCode ?? apiError.body?.code ?? apiError.code;
+        if (statusCode !== 422)
+            return false;
+        const message = `${apiError.body?.message ?? ''} ${ensureError(error).message}`;
+        return /\bimmutable\b|may not be changed|may not change once set/i.test(message);
+    }
     /**
      * Serialize a resource for sending to the Kubernetes API.
      * Calls toJSON() if available (to preserve arrays via custom implementation),
@@ -50,6 +81,10 @@ export class ResourceApplier {
      * Falls back to the original resource if resolution fails.
      */
     async resolveResourceReferences(resource, context, options, resourceLogger) {
+        if (!this.referenceResolver) {
+            resourceLogger.debug('Reference resolution is unavailable for this artifact applier');
+            return resource;
+        }
         try {
             resourceLogger.debug('Resolving resource references', {
                 originalMetadata: resource.metadata,
@@ -205,7 +240,7 @@ export class ResourceApplier {
      * Handle a 409 Conflict error based on the configured conflict strategy.
      * Returns the applied resource if the conflict was handled, or undefined if it wasn't.
      */
-    async handleConflictStrategy(resolvedResource, conflictStrategy, resourceLogger) {
+    async handleConflictStrategy(resolvedResource, conflictStrategy, resourceLogger, abortSignal, timeout = DEFAULT_READINESS_TIMEOUT) {
         const resourceName = resolvedResource.metadata?.name || 'unknown';
         const resourceKind = resolvedResource.kind || 'Unknown';
         const resourceNamespace = resolvedResource.metadata?.namespace;
@@ -272,14 +307,16 @@ export class ResourceApplier {
                         kind: resolvedResource.kind,
                         metadata: this.buildResourceIdentityMetadata(resolvedResource),
                     });
-                    // Wait a moment for deletion to propagate
-                    await new Promise((resolve) => setTimeout(resolve, DEFAULT_CONFLICT_RETRY_DELAY));
+                    await this.waitForResourceDeletion(resolvedResource, resourceLogger, abortSignal, timeout);
                     const cleanResource = this.serializeResourceForK8s(resolvedResource);
                     const result = await this.k8sApi.create(cleanResource);
                     resourceLogger.debug('Resource replaced successfully after 409 conflict');
                     return result;
                 }
                 catch (replaceError) {
+                    if (replaceError instanceof ResourceReplacementTimeoutError || abortSignal?.aborted) {
+                        throw replaceError;
+                    }
                     resourceLogger.warn('Failed to replace resource after 409 conflict', {
                         error: ensureError(replaceError).message,
                     });
@@ -288,11 +325,209 @@ export class ResourceApplier {
             }
         }
     }
+    async createResource(resource, resourceLogger, fieldManager) {
+        if (resource.kind === 'Secret') {
+            resourceLogger.debug('Creating Secret resource', {
+                name: resource.metadata?.name,
+                namespace: resource.metadata?.namespace,
+                hasData: 'data' in resource,
+                hasStringData: 'stringData' in resource,
+                dataKeyCount: resource.data ? Object.keys(resource.data).length : 0,
+            });
+        }
+        const manifest = this.serializeResourceForK8s(resource);
+        return fieldManager
+            ? await this.k8sApi.create(manifest, undefined, undefined, fieldManager)
+            : await this.k8sApi.create(manifest);
+    }
+    async patchResource(resource, resourceLogger, patchType = 'merge') {
+        const cleanPayload = this.buildPatchPayload(resource);
+        if (cleanPayload.kind === 'Secret') {
+            const { data: _data, stringData: _stringData, ...safePayload } = cleanPayload;
+            resourceLogger.debug('Resource exists, patching', {
+                patchPayload: safePayload,
+                redacted: ['data', 'stringData'],
+            });
+        }
+        else {
+            resourceLogger.debug('Resource exists, patching', { patchPayload: cleanPayload });
+        }
+        return await patchResourceWithCorrectContentType(this.k8sApi, cleanPayload, patchType);
+    }
+    async replaceResource(resource, exists, resourceLogger, abortSignal, timeout = DEFAULT_READINESS_TIMEOUT, fieldManager) {
+        if (exists) {
+            resourceLogger.debug('Deleting existing resource for replace policy');
+            await this.k8sApi.delete({
+                apiVersion: resource.apiVersion,
+                kind: resource.kind,
+                metadata: this.buildResourceIdentityMetadata(resource),
+            });
+            await this.waitForResourceDeletion(resource, resourceLogger, abortSignal, timeout);
+        }
+        return await this.createResource(resource, resourceLogger, fieldManager);
+    }
+    async waitForResourceDeletion(resource, resourceLogger, abortSignal, timeout = DEFAULT_READINESS_TIMEOUT) {
+        const startedAt = Date.now();
+        const identity = {
+            apiVersion: resource.apiVersion,
+            kind: resource.kind,
+            metadata: this.buildResourceIdentityMetadata(resource),
+        };
+        while (true) {
+            this.throwIfAborted(abortSignal);
+            try {
+                await this.k8sApi.read(identity);
+            }
+            catch (error) {
+                if (isNotFoundError(error))
+                    return;
+                throw error;
+            }
+            const elapsed = Date.now() - startedAt;
+            if (elapsed >= timeout) {
+                throw new ResourceReplacementTimeoutError(resource.metadata?.name || 'unknown', resource.kind || 'Unknown', timeout);
+            }
+            const delay = Math.min(DEFAULT_CONFLICT_RETRY_DELAY, Math.max(1, timeout - elapsed));
+            resourceLogger.debug('Waiting for previous resource object to finish deleting', {
+                name: resource.metadata?.name,
+                kind: resource.kind,
+                elapsed,
+                timeout,
+            });
+            await this.abortableDelay(delay, abortSignal);
+        }
+    }
+    async serverSideApply(resource, policy, resourceLogger) {
+        const manifest = this.serializeResourceForK8s(resource);
+        const apply = () => this.k8sApi.patch(manifest, undefined, undefined, policy.fieldManager, policy.fieldConflictPolicy === 'force-owned-fields', 'application/apply-patch+yaml');
+        try {
+            return await apply();
+        }
+        catch (error) {
+            if (!isNotFoundError(error))
+                throw error;
+            resourceLogger.debug('SSA target is absent; creating resource');
+            try {
+                return await this.createResource(resource, resourceLogger, policy.fieldManager);
+            }
+            catch (createError) {
+                if (!isConflictError(createError))
+                    throw createError;
+                resourceLogger.debug('SSA create raced with another writer; retrying apply');
+                return await apply();
+            }
+        }
+    }
+    async applyWithPolicy(resource, policy, resourceLogger, abortSignal, timeout = DEFAULT_READINESS_TIMEOUT) {
+        const effectivePolicy = policy ?? {
+            strategy: 'create-or-patch',
+            existingResource: 'patch',
+            immutableFieldPolicy: 'fail',
+        };
+        if (effectivePolicy.strategy === 'server-side-apply') {
+            try {
+                return {
+                    resource: await this.serverSideApply(resource, effectivePolicy, resourceLogger),
+                    operation: 'server-side-applied',
+                };
+            }
+            catch (error) {
+                if (effectivePolicy.immutableFieldPolicy === 'recreate' &&
+                    this.isImmutableFieldError(error)) {
+                    return {
+                        resource: await this.replaceResource(resource, true, resourceLogger, abortSignal, timeout, effectivePolicy.fieldManager),
+                        operation: 'recreated',
+                    };
+                }
+                throw error;
+            }
+        }
+        const existing = await this.checkResourceExists(resource, resourceLogger);
+        if (effectivePolicy.strategy === 'create-only') {
+            if (existing) {
+                throw new ResourceConflictError(resource.metadata?.name || 'unknown', resource.kind || 'Unknown', resource.metadata?.namespace);
+            }
+            return {
+                resource: await this.createResource(resource, resourceLogger),
+                operation: 'created',
+            };
+        }
+        if (effectivePolicy.strategy === 'replace') {
+            return {
+                resource: await this.replaceResource(resource, existing !== undefined, resourceLogger, abortSignal, timeout),
+                operation: existing ? 'replaced' : 'created',
+            };
+        }
+        if (!existing) {
+            return {
+                resource: await this.createResource(resource, resourceLogger),
+                operation: 'created',
+            };
+        }
+        switch (effectivePolicy.existingResource) {
+            case 'fail':
+                throw new ResourceConflictError(resource.metadata?.name || 'unknown', resource.kind || 'Unknown', resource.metadata?.namespace);
+            case 'warn':
+                resourceLogger.warn('Resource already exists; preserving it by artifact policy', {
+                    name: resource.metadata?.name,
+                    kind: resource.kind,
+                    namespace: resource.metadata?.namespace,
+                });
+                return { resource: existing, operation: 'preserved' };
+            case 'replace':
+                return {
+                    resource: await this.replaceResource(resource, true, resourceLogger, abortSignal, timeout),
+                    operation: 'replaced',
+                };
+            case 'patch': {
+                if (resource.kind !== 'Secret') {
+                    const comparison = compareKubernetesResources(resource, existing);
+                    if (comparison.equal) {
+                        resourceLogger.debug('Existing resource already matches canonical desired state', {
+                            name: resource.metadata?.name,
+                            kind: resource.kind,
+                            namespace: resource.metadata?.namespace,
+                            canonicalizers: comparison.canonicalizers,
+                        });
+                        return { resource: existing, operation: 'unchanged' };
+                    }
+                    resourceLogger.debug('Canonical desired/live drift requires patching', {
+                        name: resource.metadata?.name,
+                        kind: resource.kind,
+                        namespace: resource.metadata?.namespace,
+                        drift: formatCanonicalDrift(comparison.differences),
+                        differences: comparison.differences,
+                        canonicalizers: comparison.canonicalizers,
+                    });
+                }
+                try {
+                    return {
+                        resource: await this.patchResource(resource, resourceLogger, effectivePolicy.patchType),
+                        operation: 'patched',
+                    };
+                }
+                catch (error) {
+                    if (effectivePolicy.immutableFieldPolicy === 'recreate' &&
+                        this.isImmutableFieldError(error)) {
+                        return {
+                            resource: await this.replaceResource(resource, true, resourceLogger, abortSignal, timeout),
+                            operation: 'recreated',
+                        };
+                    }
+                    throw error;
+                }
+            }
+        }
+    }
     /**
      * Apply a resource to the Kubernetes cluster with retry logic, conflict handling,
      * and support for both create and patch operations.
      */
     async applyResourceToCluster(resolvedResource, options, resourceLogger) {
+        return this.applyArtifactResource(resolvedResource, getMetadataField(resolvedResource, 'applyPolicy'), options, resourceLogger);
+    }
+    /** Apply one compiled artifact operation through the canonical policy executor. */
+    async applyArtifactResource(resolvedResource, applyPolicy, options, resourceLogger) {
         if (options.dryRun) {
             resourceLogger.debug('Dry run mode: simulating resource creation');
             return {
@@ -311,52 +546,27 @@ export class ResourceApplier {
         };
         let lastError;
         for (let attempt = 0; attempt <= retryPolicy.maxRetries; attempt++) {
+            this.throwIfAborted(options.abortSignal);
             try {
                 resourceLogger.debug('Applying resource to cluster', { attempt });
-                // Check if resource already exists
-                const existing = await this.checkResourceExists(resolvedResource, resourceLogger);
-                let appliedResource;
-                if (existing) {
-                    // Resource exists, use patch for safer updates
-                    const cleanPayload = this.buildPatchPayload(resolvedResource);
-                    // Redact sensitive fields from Secret resources before logging
-                    if (cleanPayload.kind === 'Secret') {
-                        const { data: _data, stringData: _stringData, ...safePayload } = cleanPayload;
-                        resourceLogger.debug('Resource exists, patching', {
-                            patchPayload: safePayload,
-                            redacted: ['data', 'stringData'],
-                        });
-                    }
-                    else {
-                        resourceLogger.debug('Resource exists, patching', { patchPayload: cleanPayload });
-                    }
-                    appliedResource = await patchResourceWithCorrectContentType(this.k8sApi, cleanPayload);
-                }
-                else {
-                    // Resource does not exist, create it
-                    resourceLogger.debug('Resource does not exist, creating');
-                    // Log Secret resource metadata (sensitive fields redacted)
-                    if (resolvedResource.kind === 'Secret') {
-                        resourceLogger.debug('Creating Secret resource', {
-                            name: resolvedResource.metadata?.name,
-                            namespace: resolvedResource.metadata?.namespace,
-                            hasData: 'data' in resolvedResource,
-                            hasStringData: 'stringData' in resolvedResource,
-                            dataKeyCount: resolvedResource.data ? Object.keys(resolvedResource.data).length : 0,
-                        });
-                    }
-                    const cleanResource = this.serializeResourceForK8s(resolvedResource);
-                    appliedResource = await this.k8sApi.create(cleanResource);
-                }
+                const { resource: appliedResource, operation } = await this.applyWithPolicy(resolvedResource, applyPolicy, resourceLogger, options.abortSignal, options.timeout ?? DEFAULT_READINESS_TIMEOUT);
                 resourceLogger.debug('Resource applied successfully', {
                     appliedName: appliedResource.metadata?.name,
                     appliedNamespace: appliedResource.metadata?.namespace,
-                    operation: existing ? 'patched' : 'created',
+                    operation,
                     attempt,
                 });
                 return appliedResource;
             }
             catch (error) {
+                if (options.abortSignal?.aborted) {
+                    throw options.abortSignal.reason ?? error;
+                }
+                if (error instanceof ResourceConflictError ||
+                    error instanceof ResourceReplacementTimeoutError ||
+                    error instanceof ServerSideApplyConflictError) {
+                    throw error;
+                }
                 lastError = ensureError(error);
                 // Check for 409 Conflict errors - resource already exists
                 const apiError = error;
@@ -365,8 +575,17 @@ export class ResourceApplier {
                     apiError.body?.code === 409 ||
                     (typeof apiError.message === 'string' && apiError.message.includes('HTTP-Code: 409'));
                 if (is409) {
-                    const conflictStrategy = options.conflictStrategy || 'warn';
-                    const result = await this.handleConflictStrategy(resolvedResource, conflictStrategy, resourceLogger);
+                    if (applyPolicy?.strategy === 'server-side-apply') {
+                        throw new ServerSideApplyConflictError(resolvedResource.metadata?.name || 'unknown', resolvedResource.kind || 'Unknown', applyPolicy.fieldManager, applyPolicy.fieldConflictPolicy, ensureError(error));
+                    }
+                    const conflictStrategy = applyPolicy?.strategy === 'create-or-patch'
+                        ? applyPolicy.existingResource
+                        : applyPolicy?.strategy === 'replace'
+                            ? 'replace'
+                            : applyPolicy?.strategy === 'create-only'
+                                ? 'fail'
+                                : options.conflictStrategy || 'warn';
+                    const result = await this.handleConflictStrategy(resolvedResource, conflictStrategy, resourceLogger, options.abortSignal, options.timeout ?? DEFAULT_READINESS_TIMEOUT);
                     if (result) {
                         return result;
                     }
@@ -389,7 +608,7 @@ export class ResourceApplier {
                     delay,
                 });
                 // Wait before retrying
-                await new Promise((resolve) => setTimeout(resolve, delay));
+                await this.abortableDelay(delay, options.abortSignal);
             }
         }
         // This should be unreachable due to the throw in the last attempt, but TypeScript needs it