typekro 0.3.0 → 0.4.0

package/dist/core/deployment/engine.js

@@ -4,13 +4,13 @@
  * Orchestrates the deployment of Kubernetes resources directly to a cluster
  * without requiring the Kro controller, using in-process dependency resolution.
  */
-import * as k8s from '@kubernetes/client-node';
 import { ensureReadinessEvaluator } from '../../utils/helpers.js';
 import { DependencyResolver } from '../dependencies/index.js';
 import { CircularDependencyError } from '../errors.js';
+import { createBunCompatibleKubernetesObjectApi } from '../kubernetes/index.js';
 import { getComponentLogger } from '../logging/index.js';
 import { DeploymentMode, ReferenceResolver } from '../references/index.js';
-import { ResourceDeploymentError } from '../types/deployment.js';
+import { ResourceDeploymentError, ResourceConflictError, UnsupportedMediaTypeError } from '../types/deployment.js';
 import { createDebugLoggerFromDeploymentOptions } from './debug-logger.js';
 import { ResourceReadinessChecker } from './readiness.js';
 import { StatusHydrator } from './status-hydrator.js';
@@ -27,6 +27,7 @@ export class DirectDeploymentEngine {
     eventMonitor;
     deploymentState = new Map();
     readyResources = new Set(); // Track resources that are already ready
+    activeAbortControllers = new Set(); // Track active abort controllers for cleanup
     logger = getComponentLogger('deployment-engine');
     constructor(kubeClient, k8sApi, referenceResolver, deploymentMode = DeploymentMode.DIRECT) {
         this.kubeClient = kubeClient;
@@ -34,7 +35,9 @@ export class DirectDeploymentEngine {
         this.dependencyResolver = new DependencyResolver();
         this.referenceResolver =
             referenceResolver || new ReferenceResolver(kubeClient, this.deploymentMode, k8sApi);
-        this.k8sApi = k8sApi || kubeClient.makeApiClient(k8s.KubernetesObjectApi);
+        // Use createBunCompatibleKubernetesObjectApi which handles both Bun and Node.js
+        // This works around Bun's fetch TLS issues (https://github.com/oven-sh/bun/issues/10642)
+        this.k8sApi = k8sApi || createBunCompatibleKubernetesObjectApi(kubeClient);
         this.readinessChecker = new ResourceReadinessChecker(this.k8sApi);
         this.statusHydrator = new StatusHydrator(this.k8sApi);
         // this.eventFilter = createEventFilter();
@@ -48,6 +51,94 @@ export class DirectDeploymentEngine {
             });
         });
     }
+    /**
+     * Create an abortable delay that can be cancelled via AbortSignal
+     * @param ms - Delay in milliseconds
+     * @param signal - Optional AbortSignal to cancel the delay
+     * @returns Promise that resolves after the delay or rejects if aborted
+     */
+    abortableDelay(ms, signal) {
+        return new Promise((resolve, reject) => {
+            if (signal?.aborted) {
+                reject(new DOMException('Delay aborted', 'AbortError'));
+                return;
+            }
+            const timeoutId = setTimeout(() => {
+                resolve();
+            }, ms);
+            signal?.addEventListener('abort', () => {
+                clearTimeout(timeoutId);
+                reject(new DOMException('Delay aborted', 'AbortError'));
+            }, { once: true });
+        });
+    }
+    /**
+     * Wrap an async operation with abort signal handling
+     * If the signal is aborted, the promise will reject with AbortError
+     * Note: This doesn't actually cancel the underlying operation, but it allows
+     * the caller to stop waiting for it and handle the abort gracefully
+     * @param operation - The async operation to wrap
+     * @param signal - Optional AbortSignal to cancel the wait
+     * @returns Promise that resolves with the operation result or rejects if aborted
+     */
+    async withAbortSignal(operation, signal) {
+        if (!signal) {
+            return operation;
+        }
+        if (signal.aborted) {
+            throw new DOMException('Operation aborted', 'AbortError');
+        }
+        return new Promise((resolve, reject) => {
+            const abortHandler = () => {
+                reject(new DOMException('Operation aborted', 'AbortError'));
+            };
+            signal.addEventListener('abort', abortHandler, { once: true });
+            operation
+                .then((result) => {
+                signal.removeEventListener('abort', abortHandler);
+                resolve(result);
+            })
+                .catch((error) => {
+                signal.removeEventListener('abort', abortHandler);
+                // If the signal was aborted, throw AbortError instead of the original error
+                if (signal.aborted) {
+                    reject(new DOMException('Operation aborted', 'AbortError'));
+                }
+                else {
+                    reject(error);
+                }
+            });
+        });
+    }
+    /**
+     * Create and track an AbortController for a deployment operation
+     * @returns AbortController that is tracked for cleanup
+     */
+    createTrackedAbortController() {
+        const controller = new AbortController();
+        this.activeAbortControllers.add(controller);
+        return controller;
+    }
+    /**
+     * Remove an AbortController from tracking
+     * @param controller - The AbortController to remove
+     */
+    removeTrackedAbortController(controller) {
+        this.activeAbortControllers.delete(controller);
+    }
+    /**
+     * Abort all active operations and clean up
+     * This is called when a deployment times out or is cancelled
+     */
+    abortAllOperations() {
+        this.logger.debug('Aborting all active operations', {
+            activeControllers: this.activeAbortControllers.size,
+        });
+        for (const controller of this.activeAbortControllers) {
+            controller.abort();
+        }
+        this.activeAbortControllers.clear();
+    }
     /**
      * Get the Kubernetes API client for external integrations
      * @returns The configured KubernetesObjectApi instance
@@ -55,6 +146,41 @@ export class DirectDeploymentEngine {
     getKubernetesApi() {
         return this.k8sApi;
     }
+    /**
+     * Enhance a resource for evaluation by applying kind-specific logic
+     * This allows generic evaluators to work correctly without needing special cases
+     */
+    enhanceResourceForEvaluation(resource, kind) {
+        // For HelmRepository resources, handle OCI special case
+        if (kind === 'HelmRepository') {
+            const spec = resource.spec;
+            const isOciRepository = spec?.type === 'oci';
+            const hasBeenProcessed = resource.metadata?.generation && resource.metadata?.resourceVersion;
+            // If it's an OCI repo without Ready condition, synthesize one
+            // OCI repositories don't get status conditions from Flux, but they are functional
+            // once they've been processed (have generation and resourceVersion)
+            if (isOciRepository &&
+                hasBeenProcessed &&
+                !resource.status?.conditions?.some((c) => c.type === 'Ready')) {
+                return {
+                    ...resource,
+                    status: {
+                        ...resource.status,
+                        conditions: [
+                            ...(resource.status?.conditions || []),
+                            {
+                                type: 'Ready',
+                                status: 'True',
+                                message: 'OCI repository is functional',
+                                reason: 'OciRepositoryProcessed',
+                            },
+                        ],
+                    },
+                };
+            }
+        }
+        return resource;
+    }
     /**
      * Check if a deployed resource is ready using the factory-provided readiness evaluator
      */
@@ -75,9 +201,12 @@ export class DirectDeploymentEngine {
                     },
                 };
                 // Get the live resource from the cluster
+                // In the new API, methods return objects directly (no .body wrapper)
                 const liveResource = await this.k8sApi.read(resourceRef);
+                // Apply kind-specific enhancements before calling custom evaluator
+                const enhancedResource = this.enhanceResourceForEvaluation(liveResource, deployedResource.kind);
                 // Use the factory-provided readiness evaluator
-                const result = readinessEvaluator(liveResource.body);
+                const result = readinessEvaluator(enhancedResource);
                 let readinessResult;
                 if (typeof result === 'boolean') {
                     readinessResult = { ready: result };
@@ -108,8 +237,9 @@ export class DirectDeploymentEngine {
                         namespace: deployedResource.namespace,
                     },
                 };
+                // In the new API, methods return objects directly (no .body wrapper)
                 const liveResource = await this.k8sApi.read(resourceRef);
-                return this.readinessChecker.isResourceReady(liveResource.body);
+                return this.readinessChecker.isResourceReady(liveResource);
             }
         }
         catch (error) {
@@ -136,6 +266,18 @@ export class DirectDeploymentEngine {
         const deploymentId = this.generateDeploymentId();
         const startTime = Date.now();
         const deployedResources = [];
+        // Create an AbortController for this deployment to enable proper cancellation
+        const deploymentAbortController = this.createTrackedAbortController();
+        const abortSignal = deploymentAbortController.signal;
+        // Set up timeout-based abort if timeout is specified
+        const timeout = options.timeout || 300000; // 5 minutes default
+        const timeoutId = setTimeout(() => {
+            this.logger.debug('Deployment timeout reached, aborting operations', {
+                deploymentId,
+                timeout,
+            });
+            deploymentAbortController.abort();
+        }, timeout);
         const errors = [];
         const deploymentLogger = this.logger.child({
             deploymentId,
@@ -185,10 +327,31 @@ export class DirectDeploymentEngine {
                 this.readinessChecker.setDebugLogger(this.debugLogger);
                 deploymentLogger.debug('Debug logging initialized');
             }
-            // 4. Create resolution context
+            // 4. Create resolution context with resourceKeyMapping for cross-resource references
+            // The resourceKeyMapping maps original resource IDs (like 'webappDeployment') to their manifests
+            // This allows the reference resolver to find resources by their original IDs during deployment
+            const resourceKeyMapping = new Map();
+            for (const resource of graph.resources) {
+                const manifest = resource.manifest;
+                const originalResourceId = manifest.__resourceId;
+                if (originalResourceId) {
+                    // Convert the Enhanced proxy to a plain object for reliable field extraction
+                    // The proxy's toJSON method returns a clean object without proxy behavior
+                    const plainManifest = typeof manifest.toJSON === 'function'
+                        ? manifest.toJSON()
+                        : JSON.parse(JSON.stringify(manifest));
+                    resourceKeyMapping.set(originalResourceId, plainManifest);
+                    deploymentLogger.debug('Added resource to resourceKeyMapping', {
+                        originalResourceId,
+                        kind: manifest.kind,
+                        name: manifest.metadata?.name,
+                    });
+                }
+            }
             const context = {
                 deployedResources,
                 kubeClient: this.kubeClient,
+                resourceKeyMapping,
                 ...(options.namespace && { namespace: options.namespace }),
                 timeout: options.timeout || 30000,
             };
@@ -232,7 +395,7 @@ export class DirectDeploymentEngine {
                     try {
                         resourceLogger.debug('Calling deploySingleResource');
                         // Wait for CRD establishment if this is a custom resource
-                        await this.waitForCRDIfCustomResource(resource.manifest, options, resourceLogger);
+                        await this.waitForCRDIfCustomResource(resource.manifest, options, resourceLogger, abortSignal);
                         // FIX: Unconditionally ensure the readiness evaluator is attached just before deployment.
                         const resourceWithEvaluator = ensureReadinessEvaluator(resource.manifest);
                         // Add resource to event monitoring before deployment to capture creation events
@@ -254,7 +417,7 @@ export class DirectDeploymentEngine {
                                 resourceLogger.warn('Failed to add resource to event monitoring, continuing deployment', error);
                             }
                         }
-                        const deployedResource = await this.deploySingleResource(resourceWithEvaluator, context, options);
+                        const deployedResource = await this.deploySingleResource(resourceWithEvaluator, context, options, abortSignal);
                         resourceLogger.debug('Resource deployed successfully');
                         return {
                             success: true,
@@ -296,6 +459,37 @@ export class DirectDeploymentEngine {
                         const deploymentResult = result.value;
                         if (deploymentResult.success && deploymentResult.deployedResource) {
                             deployedResources.push(deploymentResult.deployedResource);
+                            // Update resourceKeyMapping with the live resource from the cluster (including status)
+                            // This is critical for CEL expression evaluation which needs access to resource status
+                            const deployedRes = deploymentResult.deployedResource;
+                            const manifestWithId = deployedRes.manifest;
+                            const originalResourceId = manifestWithId.__resourceId;
+                            if (originalResourceId && resourceKeyMapping.has(originalResourceId)) {
+                                try {
+                                    // Query the live resource from the cluster to get its current status
+                                    const liveResource = await this.k8sApi.read({
+                                        apiVersion: deployedRes.manifest.apiVersion || '',
+                                        kind: deployedRes.kind,
+                                        metadata: {
+                                            name: deployedRes.name,
+                                            namespace: deployedRes.namespace,
+                                        },
+                                    });
+                                    resourceKeyMapping.set(originalResourceId, liveResource);
+                                    deploymentLogger.debug('Updated resourceKeyMapping with live resource status', {
+                                        originalResourceId,
+                                        kind: deployedRes.kind,
+                                        name: deployedRes.name,
+                                        hasStatus: !!liveResource.status,
+                                    });
+                                }
+                                catch (error) {
+                                    deploymentLogger.warn('Failed to update resourceKeyMapping with live resource', {
+                                        originalResourceId,
+                                        error: error instanceof Error ? error.message : String(error),
+                                    });
+                                }
+                            }
                         }
                         else {
                             levelHasFailures = true;
@@ -378,6 +572,9 @@ export class DirectDeploymentEngine {
                     deploymentLogger.warn('Failed to stop event monitoring cleanly', error);
                 }
             }
+            // Clean up abort controller and timeout
+            clearTimeout(timeoutId);
+            this.removeTrackedAbortController(deploymentAbortController);
             // Store deployment state for rollback
             this.deploymentState.set(deploymentId, {
                 deploymentId,
@@ -400,8 +597,14 @@ export class DirectDeploymentEngine {
         catch (error) {
             // Re-throw circular dependency errors immediately - these are configuration errors
             if (error instanceof CircularDependencyError) {
+                // Clean up abort controller and timeout before re-throwing
+                clearTimeout(timeoutId);
+                this.removeTrackedAbortController(deploymentAbortController);
                 throw error;
             }
+            // Clean up abort controller and timeout
+            clearTimeout(timeoutId);
+            this.removeTrackedAbortController(deploymentAbortController);
             const duration = Date.now() - startTime;
             this.emitEvent(options, {
                 type: 'failed',
@@ -556,6 +759,18 @@ export class DirectDeploymentEngine {
             resourceCount: graph.resources.length,
             closureCount: Object.keys(closures).length,
         });
+        // Create an AbortController for this deployment to enable proper cancellation
+        const deploymentAbortController = this.createTrackedAbortController();
+        const abortSignal = deploymentAbortController.signal;
+        // Set up timeout-based abort if timeout is specified
+        const timeout = options.timeout || 300000; // 5 minutes default
+        const timeoutId = setTimeout(() => {
+            deploymentLogger.debug('Deployment timeout reached, aborting operations', {
+                deploymentId,
+                timeout,
+            });
+            deploymentAbortController.abort();
+        }, timeout);
         deploymentLogger.info('Starting deployment with closures', {
             options,
             closures: Object.keys(closures),
@@ -588,10 +803,30 @@ export class DirectDeploymentEngine {
                 totalClosures: enhancedPlan.totalClosures,
                 maxParallelism: enhancedPlan.maxParallelism,
             });
-            // 4. Create resolution context
+            // 4. Create resolution context with resourceKeyMapping for cross-resource references
+            // The resourceKeyMapping maps original resource IDs (like 'webappDeployment') to their manifests
+            const resourceKeyMapping = new Map();
+            for (const resource of graph.resources) {
+                const manifest = resource.manifest;
+                const originalResourceId = manifest.__resourceId;
+                if (originalResourceId) {
+                    // Convert the Enhanced proxy to a plain object for reliable field extraction
+                    // The proxy's toJSON method returns a clean object without proxy behavior
+                    const plainManifest = typeof manifest.toJSON === 'function'
+                        ? manifest.toJSON()
+                        : JSON.parse(JSON.stringify(manifest));
+                    resourceKeyMapping.set(originalResourceId, plainManifest);
+                    deploymentLogger.debug('Added resource to resourceKeyMapping', {
+                        originalResourceId,
+                        kind: manifest.kind,
+                        name: manifest.metadata?.name,
+                    });
+                }
+            }
             const context = {
                 deployedResources,
                 kubeClient: this.kubeClient,
+                resourceKeyMapping,
                 ...(options.namespace && { namespace: options.namespace }),
                 timeout: options.timeout || 30000,
             };
@@ -652,8 +887,10 @@ export class DirectDeploymentEngine {
                     });
                     try {
                         resourceLogger.debug('Calling deploySingleResource');
+                        // Wait for CRD establishment if this is a custom resource
+                        await this.waitForCRDIfCustomResource(resource.manifest, options, resourceLogger, abortSignal);
                         const resourceWithEvaluator = ensureReadinessEvaluator(resource.manifest);
-                        const deployedResource = await this.deploySingleResource(resourceWithEvaluator, context, options);
+                        const deployedResource = await this.deploySingleResource(resourceWithEvaluator, context, options, abortSignal);
                         resourceLogger.debug('Resource deployed successfully');
                         return {
                             success: true,
@@ -748,6 +985,37 @@ export class DirectDeploymentEngine {
                             if (deploymentResult.success && deploymentResult.deployedResource) {
                                 deployedResources.push(deploymentResult.deployedResource);
                                 successfulResources++;
+                                // Update resourceKeyMapping with the live resource from the cluster (including status)
+                                // This is critical for CEL expression evaluation which needs access to resource status
+                                const deployedRes = deploymentResult.deployedResource;
+                                const manifestWithId = deployedRes.manifest;
+                                const originalResourceId = manifestWithId.__resourceId;
+                                if (originalResourceId && resourceKeyMapping.has(originalResourceId)) {
+                                    try {
+                                        // Query the live resource from the cluster to get its current status
+                                        const liveResource = await this.k8sApi.read({
+                                            apiVersion: deployedRes.manifest.apiVersion || '',
+                                            kind: deployedRes.kind,
+                                            metadata: {
+                                                name: deployedRes.name,
+                                                namespace: deployedRes.namespace,
+                                            },
+                                        });
+                                        resourceKeyMapping.set(originalResourceId, liveResource);
+                                        deploymentLogger.debug('Updated resourceKeyMapping with live resource status', {
+                                            originalResourceId,
+                                            kind: deployedRes.kind,
+                                            name: deployedRes.name,
+                                            hasStatus: !!liveResource.status,
+                                        });
+                                    }
+                                    catch (error) {
+                                        deploymentLogger.warn('Failed to update resourceKeyMapping with live resource', {
+                                            originalResourceId,
+                                            error: error instanceof Error ? error.message : String(error),
+                                        });
+                                    }
+                                }
                             }
                             else {
                                 levelHasFailures = true;
@@ -816,6 +1084,9 @@ export class DirectDeploymentEngine {
                 message: `Deployment with closures ${status} in ${duration}ms (${enhancedPlan.totalClosures} closures + ${enhancedPlan.totalResources} resources across ${enhancedPlan.levels.length} levels)`,
                 timestamp: new Date(),
             });
+            // Clean up abort controller and timeout
+            clearTimeout(timeoutId);
+            this.removeTrackedAbortController(deploymentAbortController);
             // Store deployment state for rollback
             this.deploymentState.set(deploymentId, {
                 deploymentId,
@@ -838,8 +1109,14 @@ export class DirectDeploymentEngine {
         catch (error) {
             // Re-throw circular dependency errors immediately - these are configuration errors
             if (error instanceof CircularDependencyError) {
+                // Clean up abort controller and timeout before re-throwing
+                clearTimeout(timeoutId);
+                this.removeTrackedAbortController(deploymentAbortController);
                 throw error;
             }
+            // Clean up abort controller and timeout
+            clearTimeout(timeoutId);
+            this.removeTrackedAbortController(deploymentAbortController);
             const duration = Date.now() - startTime;
             this.emitEvent(options, {
                 type: 'failed',
@@ -877,8 +1154,14 @@ export class DirectDeploymentEngine {
   
      * Deploy a single resource
      */
-    async deploySingleResource(resource, context, options) {
-        const resourceId = resource.id || resource.__resourceId || resource.metadata?.name || 'unknown';
+    async deploySingleResource(resource, context, options, abortSignal) {
+        // Check if already aborted
+        if (abortSignal?.aborted) {
+            throw new DOMException('Operation aborted', 'AbortError');
+        }
+        // __resourceId is an internal field that may be set during resource processing
+        const resourceWithInternalId = resource;
+        const resourceId = resource.id || resourceWithInternalId.__resourceId || resource.metadata?.name || 'unknown';
         const resourceLogger = this.logger.child({
             resourceId,
             kind: resource.kind,
@@ -902,13 +1185,25 @@ export class DirectDeploymentEngine {
                 this.referenceResolver.resolveReferences(resource, context),
                 new Promise((_, reject) => setTimeout(() => reject(new Error('Reference resolution timeout')), resolveTimeout)),
             ]));
+            // Check for readinessEvaluator which may be on Enhanced resources
+            const enhancedResource = resolvedResource;
             resourceLogger.debug('References resolved successfully', {
                 resolvedMetadata: resolvedResource.metadata,
-                hasReadinessEvaluator: !!resolvedResource.readinessEvaluator,
+                hasReadinessEvaluator: !!enhancedResource.readinessEvaluator,
             });
         }
         catch (error) {
-            resourceLogger.warn('Reference resolution failed, using original resource', error);
+            // In Alchemy deployments, resourceKeyMapping is often empty because resources are deployed
+            // one at a time. This is expected behavior, so we log at debug level instead of warn.
+            const hasResourceKeyMapping = context.resourceKeyMapping && context.resourceKeyMapping.size > 0;
+            if (hasResourceKeyMapping) {
+                resourceLogger.warn('Reference resolution failed, using original resource', error);
+            }
+            else {
+                resourceLogger.debug('Reference resolution skipped (no resourceKeyMapping), using original resource', {
+                    error: error.message,
+                });
+            }
             resolvedResource = resource;
         }
         // 2. Apply namespace if specified, but only if resource doesn't already have one
@@ -931,7 +1226,8 @@ export class DirectDeploymentEngine {
                 metadata: newMetadata,
             };
             // Copy the non-enumerable readiness evaluator if it exists
-            const readinessEvaluator = resolvedResource.readinessEvaluator;
+            const resourceWithEvaluator = resolvedResource;
+            const readinessEvaluator = resourceWithEvaluator.readinessEvaluator;
             if (readinessEvaluator) {
                 Object.defineProperty(newResolvedResource, 'readinessEvaluator', {
                     value: readinessEvaluator,
@@ -940,6 +1236,16 @@ export class DirectDeploymentEngine {
                     writable: false,
                 });
             }
+            // Copy the non-enumerable __resourceId if it exists (used for cross-resource references)
+            const originalResourceId = resourceWithEvaluator.__resourceId;
+            if (originalResourceId) {
+                Object.defineProperty(newResolvedResource, '__resourceId', {
+                    value: originalResourceId,
+                    enumerable: false,
+                    configurable: true,
+                    writable: false,
+                });
+            }
             resolvedResource = newResolvedResource;
         }
         // 3. Apply the resource to the cluster (or simulate for dry run)
@@ -970,7 +1276,8 @@ export class DirectDeploymentEngine {
                     // Check if resource already exists
                     let existing;
                     try {
-                        const readResult = await this.k8sApi.read({
+                        // In the new API, methods return objects directly (no .body wrapper)
+                        existing = await this.k8sApi.read({
                             apiVersion: resolvedResource.apiVersion,
                             kind: resolvedResource.kind,
                             metadata: {
@@ -978,26 +1285,109 @@ export class DirectDeploymentEngine {
                                 namespace: resolvedResource.metadata?.namespace || 'default',
                             },
                         });
-                        existing = readResult.body;
                     }
                     catch (error) {
                         // If it's a 404, the resource doesn't exist, which is expected for creation
-                        if (error.statusCode !== 404) {
-                            resourceLogger.error('Error checking resource existence', error);
+                        const apiError = error;
+                        // Check for 404 in various error formats:
+                        // - apiError.statusCode (direct property)
+                        // - apiError.response?.statusCode (nested response)
+                        // - apiError.body?.code (body code)
+                        // - error message containing "HTTP-Code: 404"
+                        const is404 = apiError.statusCode === 404 ||
+                            apiError.response?.statusCode === 404 ||
+                            apiError.body?.code === 404 ||
+                            (typeof apiError.message === 'string' && apiError.message.includes('HTTP-Code: 404'));
+                        if (!is404) {
+                            // Also check for "Unrecognized API version and kind" errors - these indicate
+                            // the CRD is not installed yet, which should trigger CRD waiting logic
+                            const isUnrecognizedApiError = typeof apiError.message === 'string' &&
+                                apiError.message.includes('Unrecognized API version and kind');
+                            if (isUnrecognizedApiError) {
+                                resourceLogger.debug('CRD not yet registered, will retry after CRD establishment', error);
+                            }
+                            else {
+                                resourceLogger.error('Error checking resource existence', error);
+                            }
                             throw error;
                         }
+                        // 404 means resource doesn't exist - this is expected, we'll create it below
                     }
                     if (existing) {
                         // Resource exists, use patch for safer updates
-                        resourceLogger.debug('Resource exists, patching');
-                        const patchResult = await this.k8sApi.patch(resolvedResource);
-                        appliedResource = patchResult.body;
+                        // Log the full resource being patched, including non-standard fields like 'data' for Secrets
+                        const patchPayload = {
+                            apiVersion: resolvedResource.apiVersion,
+                            kind: resolvedResource.kind,
+                            metadata: resolvedResource.metadata,
+                        };
+                        // Include spec if present (most resources)
+                        if (resolvedResource.spec !== undefined) {
+                            patchPayload.spec = resolvedResource.spec;
+                        }
+                        // Include data if present (Secrets)
+                        if (resolvedResource.data !== undefined) {
+                            patchPayload.data = resolvedResource.data;
+                        }
+                        // Include stringData if present (Secrets)
+                        if (resolvedResource.stringData !== undefined) {
+                            patchPayload.stringData = resolvedResource.stringData;
+                        }
+                        // Include rules if present (RBAC resources)
+                        if (resolvedResource.rules !== undefined) {
+                            // Ensure arrays are preserved (not converted to objects with numeric keys)
+                            const rules = resolvedResource.rules;
+                            patchPayload.rules = Array.isArray(rules) ? [...rules] : rules;
+                        }
+                        // Include subjects if present (ClusterRoleBinding, RoleBinding)
+                        if (resolvedResource.subjects !== undefined) {
+                            // Ensure arrays are preserved (not converted to objects with numeric keys)
+                            const subjects = resolvedResource.subjects;
+                            patchPayload.subjects = Array.isArray(subjects) ? [...subjects] : subjects;
+                        }
+                        // Include roleRef if present (ClusterRoleBinding, RoleBinding)
+                        if (resolvedResource.roleRef !== undefined) {
+                            patchPayload.roleRef = resolvedResource.roleRef;
+                        }
+                        // Explicitly call toJSON to ensure arrays are preserved via our custom toJSON implementation
+                        // Then use JSON.parse(JSON.stringify()) to ensure we have a plain object without proxies
+                        const jsonPayload = typeof resolvedResource.toJSON === 'function'
+                            ? resolvedResource.toJSON()
+                            : patchPayload;
+                        // Deep clone to remove any proxy wrappers that might cause serialization issues
+                        const cleanPayload = JSON.parse(JSON.stringify(jsonPayload));
+                        // Strip internal TypeKro fields that should not be sent to Kubernetes
+                        // The 'id' field is used internally for resource mapping but is not a valid K8s field
+                        delete cleanPayload.id;
+                        resourceLogger.debug('Resource exists, patching', { patchPayload: cleanPayload });
+                        // In the new API, methods return objects directly (no .body wrapper)
+                        appliedResource = await this.patchResourceWithCorrectContentType(cleanPayload);
                     }
                     else {
                         // Resource does not exist, create it
                         resourceLogger.debug('Resource does not exist, creating');
-                        const createResult = await this.k8sApi.create(resolvedResource);
-                        appliedResource = createResult.body;
+                        // DEBUG: Log the resource being created for Secrets
+                        if (resolvedResource.kind === 'Secret') {
+                            resourceLogger.debug('Creating Secret resource', {
+                                name: resolvedResource.metadata?.name,
+                                hasData: 'data' in resolvedResource,
+                                hasSpec: 'spec' in resolvedResource,
+                                dataKeys: resolvedResource.data ? Object.keys(resolvedResource.data) : [],
+                                specValue: resolvedResource.spec,
+                            });
+                        }
+                        // Explicitly call toJSON to ensure arrays are preserved via our custom toJSON implementation
+                        // Then use JSON.parse(JSON.stringify()) to ensure we have a plain object without proxies
+                        const jsonResource = typeof resolvedResource.toJSON === 'function'
+                            ? resolvedResource.toJSON()
+                            : resolvedResource;
+                        // Deep clone to remove any proxy wrappers that might cause serialization issues
+                        const cleanResource = JSON.parse(JSON.stringify(jsonResource));
+                        // Strip internal TypeKro fields that should not be sent to Kubernetes
+                        // The 'id' field is used internally for resource mapping but is not a valid K8s field
+                        delete cleanResource.id;
+                        // In the new API, methods return objects directly (no .body wrapper)
+                        appliedResource = await this.k8sApi.create(cleanResource);
                     }
                     resourceLogger.debug('Resource applied successfully', {
                         appliedName: appliedResource.metadata?.name,
@@ -1010,7 +1400,121 @@ export class DirectDeploymentEngine {
                 }
                 catch (error) {
                     lastError = error;
+                    // Check for 409 Conflict errors - resource already exists
+                    const apiError = error;
+                    const is409 = apiError.statusCode === 409 ||
+                        apiError.response?.statusCode === 409 ||
+                        apiError.body?.code === 409 ||
+                        (typeof apiError.message === 'string' && apiError.message.includes('HTTP-Code: 409'));
+                    if (is409) {
+                        const conflictStrategy = options.conflictStrategy || 'warn';
+                        const resourceName = resolvedResource.metadata?.name || 'unknown';
+                        const resourceKind = resolvedResource.kind || 'Unknown';
+                        const resourceNamespace = resolvedResource.metadata?.namespace;
+                        let conflictHandled = false;
+                        resourceLogger.debug('Resource already exists (409)', {
+                            name: resourceName,
+                            kind: resourceKind,
+                            conflictStrategy,
+                        });
+                        // Handle based on conflict strategy
+                        switch (conflictStrategy) {
+                            case 'fail':
+                                // Throw error immediately - don't retry
+                                throw new ResourceConflictError(resourceName, resourceKind, resourceNamespace);
+                            case 'warn':
+                                // Log warning and treat as success - fetch existing resource
+                                resourceLogger.warn('Resource already exists, treating as success', {
+                                    name: resourceName,
+                                    kind: resourceKind,
+                                    namespace: resourceNamespace,
+                                });
+                                try {
+                                    // Fetch the existing resource to return it
+                                    appliedResource = await this.k8sApi.read({
+                                        apiVersion: resolvedResource.apiVersion,
+                                        kind: resolvedResource.kind,
+                                        metadata: {
+                                            name: resourceName,
+                                            namespace: resourceNamespace || 'default',
+                                        },
+                                    });
+                                    conflictHandled = true;
+                                }
+                                catch (readError) {
+                                    resourceLogger.warn('Failed to read existing resource after 409, falling back to patch', readError);
+                                    // Fall back to patch strategy
+                                    try {
+                                        const jsonResource = typeof resolvedResource.toJSON === 'function'
+                                            ? resolvedResource.toJSON()
+                                            : resolvedResource;
+                                        const cleanResource = JSON.parse(JSON.stringify(jsonResource));
+                                        delete cleanResource.id;
+                                        appliedResource = await this.patchResourceWithCorrectContentType(cleanResource);
+                                        resourceLogger.debug('Resource patched successfully after 409 conflict (warn fallback)');
+                                        conflictHandled = true;
+                                    }
+                                    catch (patchError) {
+                                        resourceLogger.warn('Failed to patch resource after 409 conflict', patchError);
+                                    }
+                                }
+                                break;
+                            case 'patch':
+                                // Attempt to patch the existing resource
+                                try {
+                                    const jsonResource = typeof resolvedResource.toJSON === 'function'
+                                        ? resolvedResource.toJSON()
+                                        : resolvedResource;
+                                    const cleanResource = JSON.parse(JSON.stringify(jsonResource));
+                                    delete cleanResource.id;
+                                    appliedResource = await this.patchResourceWithCorrectContentType(cleanResource);
+                                    resourceLogger.debug('Resource patched successfully after 409 conflict');
+                                    conflictHandled = true;
+                                }
+                                catch (patchError) {
+                                    resourceLogger.warn('Failed to patch resource after 409 conflict', patchError);
+                                }
+                                break;
+                            case 'replace':
+                                // Delete and recreate the resource
+                                try {
+                                    resourceLogger.debug('Deleting existing resource for replace strategy');
+                                    await this.k8sApi.delete({
+                                        apiVersion: resolvedResource.apiVersion,
+                                        kind: resolvedResource.kind,
+                                        metadata: {
+                                            name: resourceName,
+                                            namespace: resourceNamespace || 'default',
+                                        },
+                                    });
+                                    // Wait a moment for deletion to propagate
+                                    await new Promise((resolve) => setTimeout(resolve, 500));
+                                    // Create the new resource
+                                    const jsonResource = typeof resolvedResource.toJSON === 'function'
+                                        ? resolvedResource.toJSON()
+                                        : resolvedResource;
+                                    const cleanResource = JSON.parse(JSON.stringify(jsonResource));
+                                    delete cleanResource.id;
+                                    appliedResource = await this.k8sApi.create(cleanResource);
+                                    resourceLogger.debug('Resource replaced successfully after 409 conflict');
+                                    conflictHandled = true;
+                                }
+                                catch (replaceError) {
+                                    resourceLogger.warn('Failed to replace resource after 409 conflict', replaceError);
+                                }
+                                break;
+                        }
+                        // If we successfully handled the conflict, break out of retry loop
+                        if (conflictHandled) {
+                            break;
+                        }
+                    }
                     resourceLogger.error('Failed to apply resource to cluster', lastError, { attempt });
+                    // Check for HTTP 415 Unsupported Media Type errors
+                    if (this.isUnsupportedMediaTypeError(error)) {
+                        const acceptedTypes = this.extractAcceptedMediaTypes(error);
+                        throw new UnsupportedMediaTypeError(resolvedResource.metadata?.name || 'unknown', resolvedResource.kind || 'Unknown', acceptedTypes, lastError);
+                    }
                     // If this was the last attempt, throw the error
                     if (attempt >= retryPolicy.maxRetries) {
                         throw new ResourceDeploymentError(resolvedResource.metadata?.name || 'unknown', resolvedResource.kind || 'Unknown', lastError);
@@ -1040,7 +1544,7 @@ export class DirectDeploymentEngine {
         // 5. Wait for resource to be ready if requested
         if (options.waitForReady !== false) {
             resourceLogger.debug('Waiting for resource to be ready');
-            await this.waitForResourceReady(deployedResource, options);
+            await this.waitForResourceReady(deployedResource, options, abortSignal);
             deployedResource.status = 'ready';
         }
         resourceLogger.debug('Single resource deployment completed');
@@ -1048,16 +1552,23 @@ export class DirectDeploymentEngine {
     }
     /**
      * Wait for a resource to be ready
+     * @param deployedResource - The deployed resource to wait for
+     * @param options - Deployment options
+     * @param abortSignal - Optional AbortSignal to cancel the wait
      */
-    async waitForResourceReady(deployedResource, options) {
+    async waitForResourceReady(deployedResource, options, abortSignal) {
         const resourceKey = `${deployedResource.kind}/${deployedResource.name}/${deployedResource.namespace}`;
         // Check if already marked as ready
         if (deployedResource.status === 'ready' || this.readyResources.has(resourceKey)) {
             this.logger.debug('Resource already marked as ready', { resourceKey });
             return;
         }
-        // Safety-first approach: check for readiness evaluator before starting the wait loop
-        const readinessEvaluator = deployedResource.manifest.readinessEvaluator;
+        // Check if already aborted
+        if (abortSignal?.aborted) {
+            throw new DOMException('Operation aborted', 'AbortError');
+        }
+        const enhancedManifest = deployedResource.manifest;
+        const readinessEvaluator = enhancedManifest.readinessEvaluator;
         // Debug logging removed
         if (!readinessEvaluator) {
             const errorMessage = `Resource ${deployedResource.kind}/${deployedResource.name} does not have a factory-provided readiness evaluator`;
@@ -1068,17 +1579,25 @@ export class DirectDeploymentEngine {
         const timeout = options.timeout || 300000; // 5 minutes default
         let lastStatus = null;
         while (Date.now() - startTime < timeout) {
+            // Check if aborted before each iteration
+            if (abortSignal?.aborted) {
+                throw new DOMException('Operation aborted', 'AbortError');
+            }
             try {
                 // Use custom readiness evaluator
-                const { body: liveResource } = await this.k8sApi.read({
+                // In the new API, methods return objects directly (no .body wrapper)
+                // Wrap with abort signal handling to stop waiting if aborted
+                const liveResource = await this.withAbortSignal(this.k8sApi.read({
                     apiVersion: deployedResource.manifest.apiVersion || '',
                     kind: deployedResource.kind,
                     metadata: {
                         name: deployedResource.name,
                         namespace: deployedResource.namespace,
                     },
-                });
-                const result = readinessEvaluator(liveResource);
+                }), abortSignal);
+                // Apply kind-specific enhancements before calling custom evaluator
+                const enhancedResource = this.enhanceResourceForEvaluation(liveResource, deployedResource.kind);
+                const result = readinessEvaluator(enhancedResource);
                 if (typeof result === 'boolean') {
                     if (result) {
                         this.readyResources.add(resourceKey);
@@ -1114,10 +1633,22 @@ export class DirectDeploymentEngine {
                         timestamp: new Date(),
                     });
                 }
-                // Wait before next check
-                await new Promise((resolve) => setTimeout(resolve, 2000));
+                // Wait before next check - use abortable delay
+                try {
+                    await this.abortableDelay(2000, abortSignal);
+                }
+                catch (error) {
+                    if (error instanceof DOMException && (error.name === 'AbortError' || error.name === 'TimeoutError')) {
+                        throw error; // Re-throw abort/timeout errors
+                    }
+                    // Ignore other errors from delay
+                }
             }
             catch (error) {
+                // Re-throw abort/timeout errors immediately
+                if (error instanceof DOMException && (error.name === 'AbortError' || error.name === 'TimeoutError')) {
+                    throw error;
+                }
                 // Emit error status event
                 this.emitEvent(options, {
                     type: 'resource-status',
@@ -1125,8 +1656,16 @@ export class DirectDeploymentEngine {
                     message: `Unable to read resource status: ${error instanceof Error ? error.message : String(error)}`,
                     timestamp: new Date(),
                 });
-                // If we can't read the resource, it's not ready yet
-                await new Promise((resolve) => setTimeout(resolve, 2000));
+                // If we can't read the resource, it's not ready yet - use abortable delay
+                try {
+                    await this.abortableDelay(2000, abortSignal);
+                }
+                catch (delayError) {
+                    if (delayError instanceof DOMException && (delayError.name === 'AbortError' || delayError.name === 'TimeoutError')) {
+                        throw delayError; // Re-throw abort/timeout errors
+                    }
+                    // Ignore other errors from delay
+                }
             }
         }
         // Timeout reached
@@ -1206,7 +1745,8 @@ export class DirectDeploymentEngine {
             ...(options.namespace && { namespace: options.namespace }),
             timeout: options.timeout || 30000,
         };
-        return this.deploySingleResource(resource, context, options);
+        // Legacy method - no abort signal support
+        return this.deploySingleResource(resource, context, options, undefined);
     }
     /**
      * Delete a resource from the cluster
@@ -1262,7 +1802,8 @@ export class DirectDeploymentEngine {
      * Wait for resource readiness (legacy method for compatibility)
      */
     async waitForResourceReadiness(resource, options) {
-        return this.waitForResourceReady(resource, options);
+        // Legacy method - no abort signal support
+        return this.waitForResourceReady(resource, options, undefined);
     }
     /**
      * Rollback a deployment by ID
@@ -1331,6 +1872,33 @@ export class DirectDeploymentEngine {
         }
         return result;
     }
+    /**
+     * Patch a resource with the correct Content-Type header for merge patch operations
+     * This fixes HTTP 415 "Unsupported Media Type" errors that occur when using the generic patch method
+     * In the new API, methods return objects directly (no .body wrapper)
+     */
+    async patchResourceWithCorrectContentType(resource) {
+        // DEBUG: Log the resource being sent to K8s API for Secrets
+        if (resource.kind === 'Secret') {
+            const secretResource = resource;
+            this.logger.debug('Patching Secret resource', {
+                name: resource.metadata?.name,
+                hasData: 'data' in resource,
+                hasSpec: 'spec' in resource,
+                dataKeys: secretResource.data ? Object.keys(secretResource.data) : [],
+                specValue: secretResource.spec,
+            });
+        }
+        // The k8sApi.patch method requires the full content-type string for the patchStrategy parameter
+        // Use 'application/merge-patch+json' for merge patch operations
+        // See: https://kubernetes.io/docs/tasks/manage-kubernetes-objects/update-api-object-kubectl-patch/
+        return await this.k8sApi.patch(resource, undefined, // pretty
+        undefined, // dryRun
+        undefined, // fieldManager
+        undefined, // force
+        'application/merge-patch+json' // patchStrategy - must be the full content-type string
+        );
+    }
     /**
      * Check if an error is a "not found" error
      */
@@ -1344,7 +1912,11 @@ export class DirectDeploymentEngine {
     /**
      * Wait for CRD establishment if the resource is a custom resource
      */
-    async waitForCRDIfCustomResource(resource, options, logger) {
+    async waitForCRDIfCustomResource(resource, options, logger, abortSignal) {
+        // Check if already aborted
+        if (abortSignal?.aborted) {
+            throw new DOMException('Operation aborted', 'AbortError');
+        }
         // Skip if this is not a custom resource
         if (!this.isCustomResource(resource)) {
             return;
@@ -1361,7 +1933,7 @@ export class DirectDeploymentEngine {
             resourceKind: resource.kind,
             crdName,
         });
-        await this.waitForCRDEstablishment({ metadata: { name: crdName } }, options, logger);
+        await this.waitForCRDEstablishment({ metadata: { name: crdName } }, options, logger, abortSignal);
         logger.debug('CRD established, proceeding with custom resource deployment', {
             resourceKind: resource.kind,
             crdName,
@@ -1422,12 +1994,14 @@ export class DirectDeploymentEngine {
             // Try to find the CRD by querying the API
             const crds = await this.k8sApi.list('apiextensions.k8s.io/v1', 'CustomResourceDefinition');
             // Look for a CRD that matches our group and kind
-            const matchingCrd = crds.body?.items?.find((crd) => {
+            // In the new API, methods return objects directly (no .body wrapper)
+            const crdList = crds;
+            const matchingCrd = crdList?.items?.find((crd) => {
                 const crdSpec = crd.spec;
                 return crdSpec?.group === group && crdSpec?.names?.kind === resource.kind;
             });
             if (matchingCrd) {
-                return matchingCrd.metadata?.name;
+                return matchingCrd.metadata?.name ?? null;
             }
         }
         catch (error) {
@@ -1442,32 +2016,39 @@ export class DirectDeploymentEngine {
     /**
      * Public method to wait for CRD readiness by name
      */
-    async waitForCRDReady(crdName, timeout = 300000) {
+    async waitForCRDReady(crdName, timeout = 300000, abortSignal) {
         const logger = this.logger.child({ crdName, timeout });
         const options = {
             mode: this.deploymentMode,
             timeout,
         };
-        await this.waitForCRDEstablishment({ metadata: { name: crdName } }, options, logger);
+        await this.waitForCRDEstablishment({ metadata: { name: crdName } }, options, logger, abortSignal);
     }
     /**
      * Wait for a CRD to be established in the cluster
      */
-    async waitForCRDEstablishment(crd, options, logger) {
+    async waitForCRDEstablishment(crd, options, logger, abortSignal) {
         const crdName = crd.metadata?.name;
         const timeout = options.timeout || 300000; // 5 minutes default
         const startTime = Date.now();
         const pollInterval = 2000; // 2 seconds
         logger.debug('Waiting for CRD to exist and be established', { crdName, timeout });
         while (Date.now() - startTime < timeout) {
+            // Check if aborted before each iteration
+            if (abortSignal?.aborted) {
+                throw new DOMException('Operation aborted', 'AbortError');
+            }
             try {
                 // Check if CRD is established by reading its status
-                const crdStatus = await this.k8sApi.read({
+                // Wrap with abort signal handling
+                const crdStatus = await this.withAbortSignal(this.k8sApi.read({
                     apiVersion: 'apiextensions.k8s.io/v1',
                     kind: 'CustomResourceDefinition',
                     metadata: { name: crdName }, // CRDs are cluster-scoped, no namespace needed
-                });
-                const conditions = crdStatus.body?.status?.conditions || [];
+                }), abortSignal);
+                // In the new API, methods return objects directly (no .body wrapper)
+                const crdItem = crdStatus;
+                const conditions = crdItem?.status?.conditions || [];
                 const establishedCondition = conditions.find((c) => c.type === 'Established');
                 if (establishedCondition?.status === 'True') {
                     logger.debug('CRD exists and is established', { crdName });
@@ -1479,6 +2060,10 @@ export class DirectDeploymentEngine {
                 });
             }
             catch (error) {
+                // Re-throw abort/timeout errors immediately
+                if (error instanceof DOMException && (error.name === 'AbortError' || error.name === 'TimeoutError')) {
+                    throw error;
+                }
                 // CRD might not exist yet (e.g., being installed by a closure)
                 // This is expected in scenarios where closures install CRDs
                 logger.debug('CRD not found yet, waiting for it to be created...', {
@@ -1486,11 +2071,54 @@ export class DirectDeploymentEngine {
                     error: error.message,
                 });
             }
-            // Wait before next poll
-            await new Promise((resolve) => setTimeout(resolve, pollInterval));
+            // Wait before next poll - use abortable delay
+            try {
+                await this.abortableDelay(pollInterval, abortSignal);
+            }
+            catch (error) {
+                if (error instanceof DOMException && (error.name === 'AbortError' || error.name === 'TimeoutError')) {
+                    throw error; // Re-throw abort/timeout errors
+                }
+                // Ignore other errors from delay
+            }
         }
         // Timeout reached
         throw new Error(`Timeout waiting for CRD ${crdName} to be established after ${timeout}ms`);
     }
+    /**
+     * Check if an error is an HTTP 415 Unsupported Media Type error
+     */
+    isUnsupportedMediaTypeError(error) {
+        if (!error || typeof error !== 'object') {
+            return false;
+        }
+        const apiError = error;
+        return (apiError.statusCode === 415 ||
+            apiError.response?.statusCode === 415 ||
+            apiError.body?.code === 415);
+    }
+    /**
+     * Extract accepted media types from HTTP 415 error message
+     */
+    extractAcceptedMediaTypes(error) {
+        const defaultTypes = [
+            'application/json-patch+json',
+            'application/merge-patch+json',
+            'application/apply-patch+yaml',
+        ];
+        try {
+            // Try to extract from error message
+            const apiError = error;
+            const message = apiError.message || apiError.body?.message || '';
+            const match = message.match(/accepted media types include: ([^"]+)/);
+            if (match && match[1]) {
+                return match[1].split(', ').map((type) => type.trim());
+            }
+        }
+        catch (_e) {
+            // Fallback to default types
+        }
+        return defaultTypes;
+    }
 }
 //# sourceMappingURL=engine.js.map