typekro 0.3.1 → 0.5.0

package/dist/core/deployment/engine.js

@@ -4,17 +4,23 @@
  * Orchestrates the deployment of Kubernetes resources directly to a cluster
  * without requiring the Kro controller, using in-process dependency resolution.
  */
-import * as k8s from '@kubernetes/client-node';
-import { ensureReadinessEvaluator } from '../../utils/helpers.js';
+import { DEFAULT_CRD_READY_TIMEOUT, DEFAULT_DEPLOYMENT_TIMEOUT, DEFAULT_READINESS_TIMEOUT, } from '../config/defaults.js';
 import { DependencyResolver } from '../dependencies/index.js';
-import { CircularDependencyError } from '../errors.js';
+import { CircularDependencyError, ensureError, ResourceGraphFactoryError } from '../errors.js';
+import { createBunCompatibleKubernetesObjectApi } from '../kubernetes/index.js';
 import { getComponentLogger } from '../logging/index.js';
+import { getResourceId as getResourceMetadataId } from '../metadata/index.js';
+import { ensureReadinessEvaluator } from '../readiness/index.js';
 import { DeploymentMode, ReferenceResolver } from '../references/index.js';
-import { ResourceDeploymentError, UnsupportedMediaTypeError } from '../types/deployment.js';
+import { getResourceId } from '../resources/id.js';
+import { analyzeClosureDependencies, integrateClosuresIntoPlan } from './closure-planner.js';
+import { CRDManager } from './crd-manager.js';
 import { createDebugLoggerFromDeploymentOptions } from './debug-logger.js';
-import { ResourceReadinessChecker } from './readiness.js';
-import { StatusHydrator } from './status-hydrator.js';
 import { createEventMonitor } from './event-monitor.js';
+import { ResourceReadinessChecker } from './readiness.js';
+import { ReadinessWaiter } from './readiness-waiter.js';
+import { ResourceApplier } from './resource-applier.js';
+import { ResourceRollbackManager } from './rollback-manager.js';
 export class DirectDeploymentEngine {
     kubeClient;
     deploymentMode;
@@ -22,22 +28,35 @@ export class DirectDeploymentEngine {
     referenceResolver;
     k8sApi;
     readinessChecker;
-    statusHydrator;
+    resourceApplier;
+    rollbackManager;
+    readinessWaiter;
     debugLogger;
     eventMonitor;
     deploymentState = new Map();
+    crdManager;
     readyResources = new Set(); // Track resources that are already ready
+    activeAbortControllers = new Set(); // Track active abort controllers for cleanup
     logger = getComponentLogger('deployment-engine');
-    constructor(kubeClient, k8sApi, referenceResolver, deploymentMode = DeploymentMode.DIRECT) {
+    constructor(kubeClient, k8sApi, referenceResolver, deploymentMode = DeploymentMode.DIRECT, httpTimeouts) {
         this.kubeClient = kubeClient;
         this.deploymentMode = deploymentMode;
         this.dependencyResolver = new DependencyResolver();
         this.referenceResolver =
             referenceResolver || new ReferenceResolver(kubeClient, this.deploymentMode, k8sApi);
-        this.k8sApi = k8sApi || kubeClient.makeApiClient(k8s.KubernetesObjectApi);
+        // Use createBunCompatibleKubernetesObjectApi which handles both Bun and Node.js
+        // This works around Bun's fetch TLS issues (https://github.com/oven-sh/bun/issues/10642)
+        // Pass HTTP timeout configuration if provided
+        this.k8sApi = k8sApi || createBunCompatibleKubernetesObjectApi(kubeClient, httpTimeouts);
         this.readinessChecker = new ResourceReadinessChecker(this.k8sApi);
-        this.statusHydrator = new StatusHydrator(this.k8sApi);
-        // this.eventFilter = createEventFilter();
+        this.resourceApplier = new ResourceApplier(this.k8sApi, this.referenceResolver, this.logger);
+        this.rollbackManager = new ResourceRollbackManager(this.k8sApi);
+        this.readinessWaiter = new ReadinessWaiter(this.k8sApi, this.readyResources, this.readinessChecker, this.logger, undefined, {
+            abortableDelay: this.abortableDelay.bind(this),
+            withAbortSignal: this.withAbortSignal.bind(this),
+            emitEvent: this.emitEvent.bind(this),
+        });
+        this.crdManager = new CRDManager(this.k8sApi, kubeClient, this.abortableDelay.bind(this), this.withAbortSignal.bind(this));
         // Set up callback to track ready resources
         this.readinessChecker.setOnResourceReady((resource) => {
             const resourceKey = `${resource.kind}/${resource.name}/${resource.namespace}`;
@@ -48,6 +67,94 @@ export class DirectDeploymentEngine {
             });
         });
     }
+    /**
+     * Create an abortable delay that can be cancelled via AbortSignal
+     * @param ms - Delay in milliseconds
+     * @param signal - Optional AbortSignal to cancel the delay
+     * @returns Promise that resolves after the delay or rejects if aborted
+     */
+    abortableDelay(ms, signal) {
+        return new Promise((resolve, reject) => {
+            if (signal?.aborted) {
+                reject(new DOMException('Delay aborted', 'AbortError'));
+                return;
+            }
+            const timeoutId = setTimeout(() => {
+                resolve();
+            }, ms);
+            signal?.addEventListener('abort', () => {
+                clearTimeout(timeoutId);
+                reject(new DOMException('Delay aborted', 'AbortError'));
+            }, { once: true });
+        });
+    }
+    /**
+     * Wrap an async operation with abort signal handling
+     * If the signal is aborted, the promise will reject with AbortError
+     * Note: This doesn't actually cancel the underlying operation, but it allows
+     * the caller to stop waiting for it and handle the abort gracefully
+     * @param operation - The async operation to wrap
+     * @param signal - Optional AbortSignal to cancel the wait
+     * @returns Promise that resolves with the operation result or rejects if aborted
+     */
+    async withAbortSignal(operation, signal) {
+        if (!signal) {
+            return operation;
+        }
+        if (signal.aborted) {
+            throw new DOMException('Operation aborted', 'AbortError');
+        }
+        return new Promise((resolve, reject) => {
+            const abortHandler = () => {
+                reject(new DOMException('Operation aborted', 'AbortError'));
+            };
+            signal.addEventListener('abort', abortHandler, { once: true });
+            operation
+                .then((result) => {
+                signal.removeEventListener('abort', abortHandler);
+                resolve(result);
+            })
+                .catch((error) => {
+                signal.removeEventListener('abort', abortHandler);
+                // If the signal was aborted, throw AbortError instead of the original error
+                if (signal.aborted) {
+                    reject(new DOMException('Operation aborted', 'AbortError'));
+                }
+                else {
+                    reject(error);
+                }
+            });
+        });
+    }
+    /**
+     * Create and track an AbortController for a deployment operation
+     * @returns AbortController that is tracked for cleanup
+     */
+    createTrackedAbortController() {
+        const controller = new AbortController();
+        this.activeAbortControllers.add(controller);
+        return controller;
+    }
+    /**
+     * Remove an AbortController from tracking
+     * @param controller - The AbortController to remove
+     */
+    removeTrackedAbortController(controller) {
+        this.activeAbortControllers.delete(controller);
+    }
+    /**
+     * Abort all active operations and clean up
+     * This is called when a deployment times out or is cancelled
+     */
+    abortAllOperations() {
+        this.logger.debug('Aborting all active operations', {
+            activeControllers: this.activeAbortControllers.size,
+        });
+        for (const controller of this.activeAbortControllers) {
+            controller.abort();
+        }
+        this.activeAbortControllers.clear();
+    }
     /**
      * Get the Kubernetes API client for external integrations
      * @returns The configured KubernetesObjectApi instance
@@ -59,69 +166,7 @@ export class DirectDeploymentEngine {
      * Check if a deployed resource is ready using the factory-provided readiness evaluator
      */
     async isDeployedResourceReady(deployedResource) {
-        try {
-            // Check if the deployed resource has a factory-provided readiness evaluator
-            const readinessEvaluator = deployedResource.manifest
-                .readinessEvaluator;
-            if (readinessEvaluator) {
-                // Use the factory-provided readiness evaluator
-                // Create a resource reference for the API call
-                const resourceRef = {
-                    apiVersion: deployedResource.manifest.apiVersion || '',
-                    kind: deployedResource.kind,
-                    metadata: {
-                        name: deployedResource.name,
-                        namespace: deployedResource.namespace,
-                    },
-                };
-                // Get the live resource from the cluster
-                const liveResource = await this.k8sApi.read(resourceRef);
-                // Use the factory-provided readiness evaluator
-                const result = readinessEvaluator(liveResource.body);
-                let readinessResult;
-                if (typeof result === 'boolean') {
-                    readinessResult = { ready: result };
-                }
-                else if (result && typeof result === 'object' && 'ready' in result) {
-                    readinessResult = result;
-                }
-                else {
-                    this.logger.warn('Readiness evaluator returned unexpected result', {
-                        resourceId: deployedResource.id,
-                        result,
-                    });
-                    readinessResult = { ready: false, reason: 'Invalid evaluator result' };
-                }
-                // Debug logging for readiness evaluation
-                if (this.debugLogger) {
-                    this.debugLogger.logReadinessEvaluation(deployedResource, readinessEvaluator, readinessResult);
-                }
-                return readinessResult.ready;
-            }
-            else {
-                // Fallback to generic readiness checker
-                const resourceRef = {
-                    apiVersion: deployedResource.manifest.apiVersion || '',
-                    kind: deployedResource.kind,
-                    metadata: {
-                        name: deployedResource.name,
-                        namespace: deployedResource.namespace,
-                    },
-                };
-                const liveResource = await this.k8sApi.read(resourceRef);
-                return this.readinessChecker.isResourceReady(liveResource.body);
-            }
-        }
-        catch (error) {
-            this.logger.debug('Failed to check resource readiness', {
-                error: error,
-                resourceId: deployedResource.id,
-                kind: deployedResource.kind,
-                name: deployedResource.name,
-                namespace: deployedResource.namespace,
-            });
-            return false;
-        }
+        return this.readinessWaiter.isDeployedResourceReady(deployedResource);
     }
     /**
      * Get all deployment states for health checking
@@ -133,6 +178,14 @@ export class DirectDeploymentEngine {
      * Deploy a resource graph to the Kubernetes cluster
      */
     async deploy(graph, options) {
+        // Delegate to deployWithClosures with no closures and a dummy spec.
+        // The closure integration code is a no-op when the closures map is empty.
+        return this.deployWithClosures(graph, {}, options, undefined);
+    }
+    /**
+     * Deploy a resource graph with deployment closures integrated into level-based execution
+     */
+    async deployWithClosures(graph, closures, options, spec, alchemyScope) {
         const deploymentId = this.generateDeploymentId();
         const startTime = Date.now();
         const deployedResources = [];
@@ -140,244 +193,39 @@ export class DirectDeploymentEngine {
         const deploymentLogger = this.logger.child({
             deploymentId,
             resourceCount: graph.resources.length,
+            closureCount: Object.keys(closures).length,
+        });
+        const { abortController: deploymentAbortController, timeoutId } = this.setupDeploymentTimeout(deploymentId, options, deploymentLogger);
+        const abortSignal = deploymentAbortController.signal;
+        deploymentLogger.info(Object.keys(closures).length === 0
+            ? 'Starting deployment'
+            : 'Starting deployment with closures', {
+            options,
+            closures: Object.keys(closures),
         });
-        deploymentLogger.info('Starting deployment', { options });
         try {
             this.emitEvent(options, {
                 type: 'started',
-                message: `Starting deployment of ${graph.resources.length} resources`,
+                message: `Starting deployment of ${graph.resources.length} resources and ${Object.keys(closures).length} closures`,
                 timestamp: new Date(),
             });
-            // 1. Validate no cycles in dependency graph
-            deploymentLogger.debug('Validating dependency graph', {
-                dependencyGraph: graph.dependencyGraph,
-            });
-            this.dependencyResolver.validateNoCycles(graph.dependencyGraph);
-            // 2. Analyze deployment order and identify parallel stages
-            deploymentLogger.debug('Analyzing deployment order for parallel execution');
-            const deploymentPlan = this.dependencyResolver.analyzeDeploymentOrder(graph.dependencyGraph);
-            deploymentLogger.debug('Deployment plan determined', {
-                levels: deploymentPlan.levels.length,
-                totalResources: deploymentPlan.totalResources,
-                maxParallelism: deploymentPlan.maxParallelism,
-            });
-            // 3. Initialize and start event monitoring if enabled
-            if (options.eventMonitoring?.enabled) {
-                try {
-                    this.eventMonitor = createEventMonitor(this.kubeClient, {
-                        namespace: options.namespace || 'default',
-                        eventTypes: options.eventMonitoring.eventTypes || ['Warning', 'Error'],
-                        includeChildResources: options.eventMonitoring.includeChildResources ?? true,
-                        startTime: new Date(startTime),
-                        ...(options.progressCallback && { progressCallback: options.progressCallback }),
-                    });
-                    // Start monitoring immediately to capture all deployment events
-                    await this.eventMonitor.startMonitoring([]);
-                    deploymentLogger.debug('Event monitoring started for deployment');
-                }
-                catch (error) {
-                    deploymentLogger.warn('Failed to initialize event monitoring, continuing without it', error);
-                }
-            }
-            // 3.1. Initialize debug logging if enabled
-            if (options.debugLogging?.enabled) {
-                this.debugLogger = createDebugLoggerFromDeploymentOptions(options);
-                this.readinessChecker.setDebugLogger(this.debugLogger);
-                deploymentLogger.debug('Debug logging initialized');
-            }
-            // 4. Create resolution context
-            const context = {
-                deployedResources,
-                kubeClient: this.kubeClient,
-                ...(options.namespace && { namespace: options.namespace }),
-                timeout: options.timeout || 30000,
-            };
-            // 5. Deploy resources in parallel stages
-            for (let levelIndex = 0; levelIndex < deploymentPlan.levels.length; levelIndex++) {
-                const currentLevel = deploymentPlan.levels[levelIndex];
+            // Validate, plan, initialize monitoring, and build resolution context
+            const { enhancedPlan, context, resourceKeyMapping } = await this.validateAndPlanDeployment(graph, closures, spec, options, startTime, deployedResources, deploymentLogger);
+            // Deploy resources and closures level by level with proper dependency handling
+            for (let levelIndex = 0; levelIndex < enhancedPlan.levels.length; levelIndex++) {
+                const currentLevel = enhancedPlan.levels[levelIndex];
                 if (!currentLevel) {
                     continue;
                 }
-                const levelLogger = deploymentLogger.child({
-                    level: levelIndex + 1,
-                    resourceCount: currentLevel.length,
-                });
-                levelLogger.debug(`Deploying level ${levelIndex + 1} with ${currentLevel.length} resources in parallel`);
-                // Track performance metrics for this level
-                const levelStartTime = Date.now();
-                // Deploy all resources in this level in parallel
-                const levelPromises = currentLevel.map(async (resourceId) => {
-                    const resourceLogger = deploymentLogger.child({ resourceId });
-                    resourceLogger.debug('Starting resource deployment');
-                    const resource = graph.resources.find((r) => r.id === resourceId);
-                    if (!resource) {
-                        resourceLogger.error('Resource not found in graph');
-                        const error = new Error(`Resource with id '${resourceId}' not found in graph`);
-                        return {
-                            success: false,
-                            resourceId,
-                            error: {
-                                resourceId,
-                                phase: 'validation',
-                                error,
-                                timestamp: new Date(),
-                            },
-                        };
-                    }
-                    resourceLogger.debug('Found resource in graph', {
-                        resourceId: resource.id,
-                        kind: resource.manifest?.kind,
-                        name: resource.manifest?.metadata?.name,
-                    });
-                    try {
-                        resourceLogger.debug('Calling deploySingleResource');
-                        // Wait for CRD establishment if this is a custom resource
-                        await this.waitForCRDIfCustomResource(resource.manifest, options, resourceLogger);
-                        // FIX: Unconditionally ensure the readiness evaluator is attached just before deployment.
-                        const resourceWithEvaluator = ensureReadinessEvaluator(resource.manifest);
-                        // Add resource to event monitoring before deployment to capture creation events
-                        if (this.eventMonitor) {
-                            const preDeployedResource = {
-                                id: resourceId,
-                                kind: resourceWithEvaluator.kind,
-                                name: resourceWithEvaluator.metadata?.name || 'unknown',
-                                namespace: resourceWithEvaluator.metadata?.namespace || options.namespace || 'default',
-                                manifest: resourceWithEvaluator,
-                                status: 'deployed',
-                                deployedAt: new Date(),
-                            };
-                            try {
-                                await this.eventMonitor.addResources([preDeployedResource]);
-                                resourceLogger.debug('Added resource to event monitoring before deployment');
-                            }
-                            catch (error) {
-                                resourceLogger.warn('Failed to add resource to event monitoring, continuing deployment', error);
-                            }
-                        }
-                        const deployedResource = await this.deploySingleResource(resourceWithEvaluator, context, options);
-                        resourceLogger.debug('Resource deployed successfully');
-                        return {
-                            success: true,
-                            resourceId,
-                            deployedResource,
-                        };
-                    }
-                    catch (error) {
-                        resourceLogger.error('Resource deployment failed', error);
-                        const failedResource = {
-                            id: resourceId,
-                            kind: resource.manifest.kind,
-                            name: resource.manifest.metadata?.name || 'unknown',
-                            namespace: resource.manifest.metadata?.namespace || 'default',
-                            manifest: resource.manifest,
-                            status: 'failed',
-                            deployedAt: new Date(),
-                            error: error,
-                        };
-                        return {
-                            success: false,
-                            resourceId,
-                            deployedResource: failedResource,
-                            error: {
-                                resourceId,
-                                phase: 'deployment',
-                                error: error,
-                                timestamp: new Date(),
-                            },
-                        };
-                    }
-                });
-                // Wait for all resources in this level to complete
-                const levelResults = await Promise.allSettled(levelPromises);
-                // Process results and handle errors
-                let levelHasFailures = false;
-                for (const result of levelResults) {
-                    if (result.status === 'fulfilled') {
-                        const deploymentResult = result.value;
-                        if (deploymentResult.success && deploymentResult.deployedResource) {
-                            deployedResources.push(deploymentResult.deployedResource);
-                        }
-                        else {
-                            levelHasFailures = true;
-                            if (deploymentResult.error) {
-                                errors.push(deploymentResult.error);
-                            }
-                            if (deploymentResult.deployedResource) {
-                                deployedResources.push(deploymentResult.deployedResource);
-                            }
-                        }
-                    }
-                    else {
-                        // Promise was rejected
-                        levelHasFailures = true;
-                        levelLogger.error('Unexpected promise rejection in parallel deployment', result.reason);
-                    }
-                }
-                // Resources are now added to event monitoring before deployment (see individual resource deployment above)
-                // Handle rollback if there are failures and rollback is enabled
-                if (levelHasFailures && options.rollbackOnFailure) {
-                    levelLogger.warn('Level deployment failed, initiating rollback');
-                    await this.rollbackDeployedResources(deployedResources, options);
-                    const duration = Date.now() - startTime;
-                    this.emitEvent(options, {
-                        type: 'rollback',
-                        message: `Deployment failed and rolled back in ${duration}ms`,
-                        timestamp: new Date(),
-                    });
-                    return {
-                        deploymentId,
-                        resources: deployedResources,
-                        dependencyGraph: graph.dependencyGraph,
-                        duration,
-                        status: 'failed',
-                        errors,
-                    };
-                }
-                // Calculate level performance metrics
-                const levelDuration = Date.now() - levelStartTime;
-                const successfulCount = levelResults.filter((r) => r.status === 'fulfilled' && r.value.success).length;
-                const failedCount = levelResults.filter((r) => r.status === 'rejected' || (r.status === 'fulfilled' && !r.value.success)).length;
-                levelLogger.info(`Level ${levelIndex + 1} deployment completed`, {
-                    successful: successfulCount,
-                    failed: failedCount,
-                    duration: levelDuration,
-                    parallelism: currentLevel.length,
-                    averageTimePerResource: Math.round(levelDuration / currentLevel.length),
-                });
-            }
-            const duration = Date.now() - startTime;
-            const successfulResources = deployedResources.filter((r) => r.status !== 'failed');
-            const status = errors.length === 0 ? 'success' : successfulResources.length > 0 ? 'partial' : 'failed';
-            // Log comprehensive performance metrics
-            deploymentLogger.info('Parallel deployment performance metrics', {
-                totalDuration: duration,
-                totalResources: deploymentPlan.totalResources,
-                parallelLevels: deploymentPlan.levels.length,
-                maxParallelism: deploymentPlan.maxParallelism,
-                averageTimePerResource: Math.round(duration / deploymentPlan.totalResources),
-                successfulResources: successfulResources.length,
-                failedResources: errors.length,
-                parallelismEfficiency: Math.round((deploymentPlan.totalResources /
-                    deploymentPlan.levels.length /
-                    deploymentPlan.maxParallelism) *
-                    100),
-                status,
-            });
-            this.emitEvent(options, {
-                type: status === 'success' ? 'completed' : 'failed',
-                message: `Deployment ${status} in ${duration}ms (${deploymentPlan.levels.length} parallel levels, max ${deploymentPlan.maxParallelism} concurrent)`,
-                timestamp: new Date(),
-            });
-            // Stop event monitoring
-            if (this.eventMonitor) {
-                try {
-                    await this.eventMonitor.stopMonitoring();
-                    deploymentLogger.debug('Event monitoring stopped');
-                }
-                catch (error) {
-                    deploymentLogger.warn('Failed to stop event monitoring cleanly', error);
+                const earlyReturn = await this.deployLevel(levelIndex, currentLevel, graph, deployedResources, errors, context, resourceKeyMapping, options, alchemyScope, abortSignal, startTime, deploymentId, deploymentLogger);
+                // If deployLevel returned a result, it means rollback occurred — return immediately
+                if (earlyReturn) {
+                    await this.cleanupDeployment(deploymentAbortController, timeoutId, deploymentLogger);
+                    return earlyReturn;
                 }
             }
+            const result = this.buildDeploymentResult(deploymentId, graph, enhancedPlan, deployedResources, errors, startTime, options, deploymentLogger);
+            await this.cleanupDeployment(deploymentAbortController, timeoutId, deploymentLogger);
             // Store deployment state for rollback
             this.deploymentState.set(deploymentId, {
                 deploymentId,
@@ -385,39 +233,31 @@ export class DirectDeploymentEngine {
                 dependencyGraph: graph.dependencyGraph,
                 startTime: new Date(startTime),
                 endTime: new Date(),
-                status: status === 'success' ? 'completed' : status === 'partial' ? 'completed' : 'failed',
+                status: result.status === 'success'
+                    ? 'completed'
+                    : result.status === 'partial'
+                        ? 'completed'
+                        : 'failed',
                 options,
             });
-            return {
-                deploymentId,
-                resources: deployedResources,
-                dependencyGraph: graph.dependencyGraph,
-                duration,
-                status,
-                errors,
-            };
+            return result;
         }
         catch (error) {
             // Re-throw circular dependency errors immediately - these are configuration errors
             if (error instanceof CircularDependencyError) {
+                // Clean up abort controller and timeout before re-throwing
+                await this.cleanupDeployment(deploymentAbortController, timeoutId, deploymentLogger);
                 throw error;
             }
+            // Clean up abort controller and timeout
+            await this.cleanupDeployment(deploymentAbortController, timeoutId, deploymentLogger);
             const duration = Date.now() - startTime;
             this.emitEvent(options, {
                 type: 'failed',
-                message: `Deployment failed: ${error}`,
+                message: `Deployment with closures failed: ${ensureError(error).message}`,
                 timestamp: new Date(),
-                error: error,
+                error: ensureError(error),
             });
-            // Stop event monitoring on error
-            if (this.eventMonitor) {
-                try {
-                    await this.eventMonitor.stopMonitoring();
-                }
-                catch (_cleanupError) {
-                    // Ignore cleanup errors in error path
-                }
-            }
             // Store deployment state even for failed deployments (for rollback)
             this.deploymentState.set(deploymentId, {
                 deploymentId,
@@ -438,7 +278,7 @@ export class DirectDeploymentEngine {
                     {
                         resourceId: 'deployment',
                         phase: 'deployment',
-                        error: error,
+                        error: ensureError(error),
                         timestamp: new Date(),
                     },
                 ],
@@ -446,439 +286,484 @@ export class DirectDeploymentEngine {
         }
     }
     /**
-     * Analyze closure dependencies to determine execution levels
+     * Create an AbortController and set up a timeout that aborts the deployment
+     * when the configured timeout is reached. Also stops event monitoring on timeout.
+     * @param deploymentId - The unique deployment ID for logging
+     * @param options - Deployment options containing the timeout configuration
+     * @param deploymentLogger - Logger scoped to this deployment
+     * @returns The AbortController and timeout ID for cleanup
      */
-    analyzeClosureDependencies(closures, spec, dependencyGraph) {
-        const closureDependencies = [];
-        for (const [name, closure] of Object.entries(closures)) {
-            // For now, analyze dependencies by examining the closure's configuration
-            // This is a simplified implementation - in practice, we would need to analyze
-            // the closure's arguments to detect resource references
-            const dependencies = this.extractClosureDependencies(closure, spec);
-            // Determine execution level based on dependencies
-            // For now, assign all closures to level -1 to ensure they run before all resources
-            // This is especially important for closures that install CRDs (like fluxSystem)
-            let level = -1;
-            if (dependencies.length > 0) {
-                // Find the maximum level of any dependency + 1
-                for (const depId of dependencies) {
-                    const depLevel = this.getResourceLevel(depId, dependencyGraph);
-                    level = Math.max(level, depLevel + 1);
-                }
-            }
-            closureDependencies.push({
-                name,
-                closure,
-                dependencies,
-                level,
+    setupDeploymentTimeout(deploymentId, options, deploymentLogger) {
+        const abortController = this.createTrackedAbortController();
+        const timeout = options.timeout || DEFAULT_DEPLOYMENT_TIMEOUT;
+        const timeoutId = setTimeout(() => {
+            deploymentLogger.debug('Deployment timeout reached, aborting operations', {
+                deploymentId,
+                timeout,
             });
-        }
-        return closureDependencies;
-    }
-    /**
-     * Extract dependencies from a closure by analyzing its configuration
-     * This is a simplified implementation - in practice, we would need more sophisticated analysis
-     */
-    extractClosureDependencies(_closure, _spec) {
-        // For now, return empty dependencies since closures typically don't depend on Enhanced<> resources
-        // In the future, this could analyze closure arguments for resource references
-        return [];
+            // Stop event monitoring immediately when timeout is reached
+            // This prevents watch connections from continuing to run and throwing errors
+            if (this.eventMonitor) {
+                this.eventMonitor.stopMonitoring().catch((error) => {
+                    deploymentLogger.debug('Error stopping event monitoring on timeout', {
+                        error: ensureError(error).message,
+                    });
+                });
+            }
+            abortController.abort();
+        }, timeout);
+        return { abortController, timeoutId };
     }
     /**
-     * Get the execution level of a resource in the dependency graph
+     * Validate the dependency graph for cycles, analyze deployment order,
+     * integrate closures into the plan, initialize event/debug monitoring,
+     * and build the resource key mapping and resolution context.
+     * @param graph - The deployment resource graph
+     * @param closures - Map of deployment closures keyed by name
+     * @param spec - The resource graph spec for closure dependency analysis
+     * @param options - Deployment options
+     * @param startTime - Deployment start timestamp for event monitoring
+     * @param deployedResources - Mutable array of deployed resources (used in resolution context)
+     * @param deploymentLogger - Logger scoped to this deployment
+     * @returns Enhanced plan, resolution context, and resource key mapping
      */
-    getResourceLevel(resourceId, dependencyGraph) {
-        // Find the level where this resource appears in the deployment plan
-        const deploymentPlan = this.dependencyResolver.analyzeDeploymentOrder(dependencyGraph);
-        for (let levelIndex = 0; levelIndex < deploymentPlan.levels.length; levelIndex++) {
-            const level = deploymentPlan.levels[levelIndex];
-            if (level?.includes(resourceId)) {
-                return levelIndex;
+    async validateAndPlanDeployment(graph, closures, spec, options, startTime, deployedResources, deploymentLogger) {
+        // 1. Validate no cycles in dependency graph
+        deploymentLogger.debug('Validating dependency graph', {
+            dependencyGraph: graph.dependencyGraph,
+        });
+        this.dependencyResolver.validateNoCycles(graph.dependencyGraph);
+        // 2. Analyze deployment order and identify parallel stages
+        deploymentLogger.debug('Analyzing deployment order for parallel execution');
+        const deploymentPlan = this.dependencyResolver.analyzeDeploymentOrder(graph.dependencyGraph);
+        deploymentLogger.debug('Deployment plan determined', {
+            levels: deploymentPlan.levels.length,
+            totalResources: deploymentPlan.totalResources,
+            maxParallelism: deploymentPlan.maxParallelism,
+        });
+        // 3. Initialize and start event monitoring if enabled
+        await this.initializeEventMonitoring(options, startTime, deploymentLogger);
+        // 3.1. Initialize debug logging if enabled
+        if (options.debugLogging?.enabled) {
+            this.debugLogger = createDebugLoggerFromDeploymentOptions(options);
+            this.readinessChecker.setDebugLogger(this.debugLogger);
+            deploymentLogger.debug('Debug logging initialized');
+        }
+        // 4. Analyze closure dependencies and integrate into deployment plan
+        const closureDependencies = analyzeClosureDependencies(closures, spec, graph.dependencyGraph, this.dependencyResolver);
+        const enhancedPlan = integrateClosuresIntoPlan(deploymentPlan, closureDependencies);
+        deploymentLogger.debug('Enhanced deployment plan with closures', {
+            levels: enhancedPlan.levels.length,
+            totalResources: enhancedPlan.totalResources,
+            totalClosures: enhancedPlan.totalClosures,
+            maxParallelism: enhancedPlan.maxParallelism,
+        });
+        // 5. Create resolution context with resourceKeyMapping for cross-resource references
+        // The resourceKeyMapping maps original resource IDs (like 'webappDeployment') to their manifests
+        const resourceKeyMapping = new Map();
+        for (const resource of graph.resources) {
+            const manifest = resource.manifest;
+            const originalResourceId = getResourceMetadataId(manifest);
+            if (originalResourceId) {
+                // Convert the Enhanced proxy to a plain object for reliable field extraction
+                // The proxy's toJSON method returns a clean object without proxy behavior
+                const plainManifest = typeof manifest.toJSON === 'function'
+                    ? manifest.toJSON()
+                    : JSON.parse(JSON.stringify(manifest));
+                resourceKeyMapping.set(originalResourceId, plainManifest);
+                deploymentLogger.debug('Added resource to resourceKeyMapping', {
+                    originalResourceId,
+                    kind: manifest.kind,
+                    name: manifest.metadata?.name,
+                });
             }
         }
-        return 0; // Default to level 0 if not found
+        const context = {
+            deployedResources,
+            kubeClient: this.kubeClient,
+            resourceKeyMapping,
+            ...(options.namespace && { namespace: options.namespace }),
+            timeout: options.timeout || DEFAULT_READINESS_TIMEOUT,
+        };
+        return { enhancedPlan, context, resourceKeyMapping };
     }
     /**
-     * Integrate closures into the deployment plan based on their dependencies
+     * Initialize and start Kubernetes event monitoring if enabled in deployment options.
+     * Logs a warning and continues if initialization fails.
+     * @param options - Deployment options containing event monitoring configuration
+     * @param startTime - Deployment start timestamp to filter events
+     * @param deploymentLogger - Logger scoped to this deployment
      */
-    integrateClosuresIntoPlan(deploymentPlan, closureDependencies) {
-        // Create enhanced levels with both resources and closures
-        const enhancedLevels = [];
-        // Check if we have any closures at level -1 (pre-resource level)
-        const preResourceClosures = closureDependencies.filter((c) => c.level === -1);
-        // If we have pre-resource closures, add them as level 0 and shift everything else
-        if (preResourceClosures.length > 0) {
-            enhancedLevels.push({
-                resources: [],
-                closures: preResourceClosures,
-            });
-        }
-        // Initialize levels with existing resources (shifted if we added a pre-resource level)
-        for (let i = 0; i < deploymentPlan.levels.length; i++) {
-            enhancedLevels.push({
-                resources: deploymentPlan.levels[i] || [],
-                closures: [],
-            });
-        }
-        // Add closures to their appropriate levels (excluding level -1 which we already handled)
-        for (const closureInfo of closureDependencies) {
-            if (closureInfo.level === -1) {
-                continue; // Already handled above
-            }
-            // Adjust level index if we added a pre-resource level
-            const adjustedLevel = preResourceClosures.length > 0 ? closureInfo.level + 1 : closureInfo.level;
-            // Ensure we have enough levels
-            while (enhancedLevels.length <= adjustedLevel) {
-                enhancedLevels.push({ resources: [], closures: [] });
+    async initializeEventMonitoring(options, startTime, deploymentLogger) {
+        if (options.eventMonitoring?.enabled) {
+            try {
+                this.eventMonitor = createEventMonitor(this.kubeClient, {
+                    namespace: options.namespace || 'default',
+                    eventTypes: options.eventMonitoring.eventTypes || ['Warning', 'Error'],
+                    includeChildResources: options.eventMonitoring.includeChildResources ?? true,
+                    startTime: new Date(startTime),
+                    ...(options.progressCallback && { progressCallback: options.progressCallback }),
+                });
+                // Start monitoring immediately to capture all deployment events
+                await this.eventMonitor.startMonitoring([]);
+                deploymentLogger.debug('Event monitoring started for deployment');
             }
-            const targetLevel = enhancedLevels[adjustedLevel];
-            if (targetLevel) {
-                targetLevel.closures.push(closureInfo);
+            catch (error) {
+                deploymentLogger.warn('Failed to initialize event monitoring, continuing without it', {
+                    error: ensureError(error).message,
+                });
             }
         }
-        return {
-            levels: enhancedLevels,
-            totalResources: deploymentPlan.totalResources,
-            totalClosures: closureDependencies.length,
-            maxParallelism: Math.max(deploymentPlan.maxParallelism, Math.max(...enhancedLevels.map((level) => level.closures.length))),
-        };
     }
     /**
-     * Deploy a resource graph with deployment closures integrated into level-based execution
+     * Deploy a single level of resources and closures in parallel. Processes results,
+     * handles rollback on failure if configured, and logs level performance metrics.
+     * Returns a DeploymentResult if rollback occurred (early exit), or undefined to continue.
+     * @param levelIndex - Zero-based index of the current level
+     * @param currentLevel - The level definition containing resource IDs and closures
+     * @param graph - The full deployment resource graph
+     * @param deployedResources - Mutable array accumulating deployed resources across levels
+     * @param errors - Mutable array accumulating deployment errors across levels
+     * @param context - Resolution context for cross-resource references
+     * @param resourceKeyMapping - Map from resource IDs to their manifests (updated with live data)
+     * @param options - Deployment options
+     * @param alchemyScope - Optional alchemy scope for closure deployment context
+     * @param abortSignal - Signal to abort deployment operations
+     * @param startTime - Deployment start timestamp (used for rollback duration calculation)
+     * @param deploymentId - Unique deployment ID for result building
+     * @param deploymentLogger - Logger scoped to this deployment
+     * @returns DeploymentResult if rollback occurred, undefined otherwise
      */
-    async deployWithClosures(graph, closures, options, spec, alchemyScope) {
-        const deploymentId = this.generateDeploymentId();
-        const startTime = Date.now();
-        const deployedResources = [];
-        const errors = [];
-        const deploymentLogger = this.logger.child({
-            deploymentId,
-            resourceCount: graph.resources.length,
-            closureCount: Object.keys(closures).length,
-        });
-        deploymentLogger.info('Starting deployment with closures', {
-            options,
-            closures: Object.keys(closures),
+    async deployLevel(levelIndex, currentLevel, graph, deployedResources, errors, context, resourceKeyMapping, options, alchemyScope, abortSignal, startTime, deploymentId, deploymentLogger) {
+        const levelLogger = deploymentLogger.child({
+            level: levelIndex + 1,
+            resourceCount: currentLevel.resources.length,
+            closureCount: currentLevel.closures.length,
         });
-        try {
-            this.emitEvent(options, {
-                type: 'started',
-                message: `Starting deployment of ${graph.resources.length} resources and ${Object.keys(closures).length} closures`,
-                timestamp: new Date(),
-            });
-            // 1. Validate no cycles in dependency graph
-            deploymentLogger.debug('Validating dependency graph', {
-                dependencyGraph: graph.dependencyGraph,
-            });
-            this.dependencyResolver.validateNoCycles(graph.dependencyGraph);
-            // 2. Analyze deployment order and identify parallel stages
-            deploymentLogger.debug('Analyzing deployment order for parallel execution');
-            const deploymentPlan = this.dependencyResolver.analyzeDeploymentOrder(graph.dependencyGraph);
-            deploymentLogger.debug('Deployment plan determined', {
-                levels: deploymentPlan.levels.length,
-                totalResources: deploymentPlan.totalResources,
-                maxParallelism: deploymentPlan.maxParallelism,
-            });
-            // 3. Analyze closure dependencies and integrate into deployment plan
-            const closureDependencies = this.analyzeClosureDependencies(closures, spec, graph.dependencyGraph);
-            const enhancedPlan = this.integrateClosuresIntoPlan(deploymentPlan, closureDependencies);
-            deploymentLogger.debug('Enhanced deployment plan with closures', {
-                levels: enhancedPlan.levels.length,
-                totalResources: enhancedPlan.totalResources,
-                totalClosures: enhancedPlan.totalClosures,
-                maxParallelism: enhancedPlan.maxParallelism,
+        levelLogger.debug(`Deploying level ${levelIndex + 1} with ${currentLevel.resources.length} resources and ${currentLevel.closures.length} closures in parallel`);
+        const levelStartTime = Date.now();
+        // Create deployment context for closures at this level
+        const deployedResourcesMap = new Map();
+        // Populate with resources from previous levels
+        for (const resource of deployedResources) {
+            deployedResourcesMap.set(resource.id, resource);
+        }
+        const deploymentContext = {
+            kubernetesApi: this.k8sApi,
+            kubeConfig: this.kubeClient,
+            ...(alchemyScope && { alchemyScope }),
+            ...(options.namespace && { namespace: options.namespace }),
+            deployedResources: deployedResourcesMap,
+            resolveReference: async (ref) => {
+                // Enhanced reference resolution - will be improved in future tasks
+                return ref;
+            },
+        };
+        // Prepare promises for both resources and closures
+        const levelPromises = [];
+        // Add resource deployment promises
+        const resourcePromises = currentLevel.resources.map(async (resourceId) => {
+            const resourceLogger = deploymentLogger.child({ resourceId });
+            resourceLogger.debug('Starting resource deployment');
+            const resource = graph.resources.find((r) => r.id === resourceId);
+            if (!resource) {
+                resourceLogger.error('Resource not found in graph');
+                const error = new Error(`Resource with id '${resourceId}' not found in graph`);
+                return {
+                    success: false,
+                    resourceId,
+                    error: {
+                        resourceId,
+                        phase: 'validation',
+                        error,
+                        timestamp: new Date(),
+                    },
+                };
+            }
+            resourceLogger.debug('Found resource in graph', {
+                resourceId: resource.id,
+                kind: resource.manifest?.kind,
+                name: resource.manifest?.metadata?.name,
             });
-            // 4. Create resolution context
-            const context = {
-                deployedResources,
-                kubeClient: this.kubeClient,
-                ...(options.namespace && { namespace: options.namespace }),
-                timeout: options.timeout || 30000,
-            };
-            // 5. Deploy resources and closures level by level with proper dependency handling
-            for (let levelIndex = 0; levelIndex < enhancedPlan.levels.length; levelIndex++) {
-                const currentLevel = enhancedPlan.levels[levelIndex];
-                if (!currentLevel) {
-                    continue;
-                }
-                const levelLogger = deploymentLogger.child({
-                    level: levelIndex + 1,
-                    resourceCount: currentLevel.resources.length,
-                    closureCount: currentLevel.closures.length,
-                });
-                levelLogger.debug(`Deploying level ${levelIndex + 1} with ${currentLevel.resources.length} resources and ${currentLevel.closures.length} closures in parallel`);
-                const levelStartTime = Date.now();
-                // Create deployment context for closures at this level
-                const deployedResourcesMap = new Map();
-                // Populate with resources from previous levels
-                for (const resource of deployedResources) {
-                    deployedResourcesMap.set(resource.id, resource);
+            try {
+                resourceLogger.debug('Calling deploySingleResource');
+                // Wait for CRD establishment if this is a custom resource
+                await this.crdManager.waitForCRDIfCustomResource(resource.manifest, options, resourceLogger, abortSignal);
+                const resourceWithEvaluator = ensureReadinessEvaluator(resource.manifest);
+                // Add resource to event monitoring before deployment to capture creation events
+                // NOTE: This is fire-and-forget to avoid blocking the deployment path.
+                if (this.eventMonitor) {
+                    const preDeployedResource = {
+                        id: resourceId,
+                        kind: resourceWithEvaluator.kind,
+                        name: resourceWithEvaluator.metadata?.name || 'unknown',
+                        namespace: resourceWithEvaluator.metadata?.namespace || options.namespace || 'default',
+                        manifest: resourceWithEvaluator,
+                        status: 'deployed',
+                        deployedAt: new Date(),
+                    };
+                    this.eventMonitor.addResources([preDeployedResource]).then(() => {
+                        resourceLogger.debug('Added resource to event monitoring before deployment');
+                    }, (error) => {
+                        resourceLogger.warn('Failed to add resource to event monitoring, continuing deployment', { error: ensureError(error).message });
+                    });
                 }
-                const deploymentContext = {
-                    kubernetesApi: this.k8sApi,
-                    ...(alchemyScope && { alchemyScope }),
-                    ...(options.namespace && { namespace: options.namespace }),
-                    deployedResources: deployedResourcesMap,
-                    resolveReference: async (ref) => {
-                        // Enhanced reference resolution - will be improved in future tasks
-                        return ref;
+                const deployedResource = await this.deploySingleResource(resourceWithEvaluator, context, options, abortSignal);
+                resourceLogger.debug('Resource deployed successfully');
+                return {
+                    success: true,
+                    resourceId,
+                    deployedResource,
+                };
+            }
+            catch (error) {
+                resourceLogger.error('Resource deployment failed', ensureError(error));
+                const failedResource = {
+                    id: resourceId,
+                    kind: resource.manifest.kind,
+                    name: resource.manifest.metadata?.name || 'unknown',
+                    namespace: resource.manifest.metadata?.namespace || 'default',
+                    manifest: resource.manifest,
+                    status: 'failed',
+                    deployedAt: new Date(),
+                    error: ensureError(error),
+                };
+                return {
+                    success: false,
+                    resourceId,
+                    deployedResource: failedResource,
+                    error: {
+                        resourceId,
+                        phase: 'deployment',
+                        error: ensureError(error),
+                        timestamp: new Date(),
                     },
                 };
-                // Prepare promises for both resources and closures
-                const levelPromises = [];
-                // Add resource deployment promises
-                const resourcePromises = currentLevel.resources.map(async (resourceId) => {
-                    const resourceLogger = deploymentLogger.child({ resourceId });
-                    resourceLogger.debug('Starting resource deployment');
-                    const resource = graph.resources.find((r) => r.id === resourceId);
-                    if (!resource) {
-                        resourceLogger.error('Resource not found in graph');
-                        const error = new Error(`Resource with id '${resourceId}' not found in graph`);
-                        return {
-                            success: false,
-                            resourceId,
-                            error: {
-                                resourceId,
-                                phase: 'validation',
-                                error,
-                                timestamp: new Date(),
-                            },
-                        };
-                    }
-                    resourceLogger.debug('Found resource in graph', {
-                        resourceId: resource.id,
-                        kind: resource.manifest?.kind,
-                        name: resource.manifest?.metadata?.name,
-                    });
-                    try {
-                        resourceLogger.debug('Calling deploySingleResource');
-                        const resourceWithEvaluator = ensureReadinessEvaluator(resource.manifest);
-                        const deployedResource = await this.deploySingleResource(resourceWithEvaluator, context, options);
-                        resourceLogger.debug('Resource deployed successfully');
-                        return {
-                            success: true,
-                            resourceId,
-                            deployedResource,
-                        };
-                    }
-                    catch (error) {
-                        resourceLogger.error('Resource deployment failed', error);
-                        const failedResource = {
-                            id: resourceId,
-                            kind: resource.manifest.kind,
-                            name: resource.manifest.metadata?.name || 'unknown',
-                            namespace: resource.manifest.metadata?.namespace || 'default',
-                            manifest: resource.manifest,
-                            status: 'failed',
-                            deployedAt: new Date(),
-                            error: error,
-                        };
-                        return {
-                            success: false,
-                            resourceId,
-                            deployedResource: failedResource,
-                            error: {
-                                resourceId,
-                                phase: 'deployment',
-                                error: error,
-                                timestamp: new Date(),
-                            },
-                        };
-                    }
+            }
+        });
+        // Add closure execution promises
+        const closurePromises = currentLevel.closures.map(async (closureInfo) => {
+            const closureLogger = levelLogger.child({ closureName: closureInfo.name });
+            closureLogger.debug('Executing closure at level', { level: levelIndex + 1 });
+            try {
+                const result = await closureInfo.closure(deploymentContext);
+                closureLogger.debug('Closure executed successfully', {
+                    resultCount: result?.length || 0,
                 });
-                // Add closure execution promises
-                const closurePromises = currentLevel.closures.map(async (closureInfo) => {
-                    const closureLogger = levelLogger.child({ closureName: closureInfo.name });
-                    closureLogger.debug('Executing closure at level', { level: levelIndex + 1 });
-                    try {
-                        const result = await closureInfo.closure(deploymentContext);
-                        closureLogger.debug('Closure executed successfully', {
-                            resultCount: result?.length || 0,
-                        });
-                        return {
-                            success: true,
-                            type: 'closure',
-                            name: closureInfo.name,
-                            result,
-                        };
-                    }
-                    catch (error) {
-                        closureLogger.error('Closure execution failed', error);
-                        return {
-                            success: false,
-                            type: 'closure',
-                            name: closureInfo.name,
-                            error: {
-                                resourceId: `closure-${closureInfo.name}`,
-                                phase: 'deployment',
-                                error: error,
-                                timestamp: new Date(),
-                            },
-                        };
+                return {
+                    success: true,
+                    type: 'closure',
+                    name: closureInfo.name,
+                    result,
+                };
+            }
+            catch (error) {
+                closureLogger.error('Closure execution failed', ensureError(error));
+                return {
+                    success: false,
+                    type: 'closure',
+                    name: closureInfo.name,
+                    error: {
+                        resourceId: `closure-${closureInfo.name}`,
+                        phase: 'deployment',
+                        error: ensureError(error),
+                        timestamp: new Date(),
+                    },
+                };
+            }
+        });
+        // Combine all promises for this level
+        levelPromises.push(...resourcePromises, ...closurePromises);
+        // Wait for all resources and closures in this level to complete
+        const levelResults = await Promise.allSettled(levelPromises);
+        // Process results and handle errors
+        let levelHasFailures = false;
+        let successfulResources = 0;
+        let successfulClosures = 0;
+        let failedResources = 0;
+        let failedClosures = 0;
+        for (const result of levelResults) {
+            if (result.status === 'fulfilled') {
+                const deploymentResult = result.value;
+                if (deploymentResult.type === 'closure') {
+                    // Handle closure result
+                    if (deploymentResult.success) {
+                        successfulClosures++;
                     }
-                });
-                // Combine all promises for this level
-                levelPromises.push(...resourcePromises, ...closurePromises);
-                // Wait for all resources and closures in this level to complete
-                const levelResults = await Promise.allSettled(levelPromises);
-                // Process results and handle errors
-                let levelHasFailures = false;
-                let successfulResources = 0;
-                let successfulClosures = 0;
-                let failedResources = 0;
-                let failedClosures = 0;
-                for (const result of levelResults) {
-                    if (result.status === 'fulfilled') {
-                        const deploymentResult = result.value;
-                        if (deploymentResult.type === 'closure') {
-                            // Handle closure result
-                            if (deploymentResult.success) {
-                                successfulClosures++;
-                            }
-                            else {
-                                levelHasFailures = true;
-                                failedClosures++;
-                                if (deploymentResult.error) {
-                                    errors.push(deploymentResult.error);
-                                }
-                            }
-                        }
-                        else {
-                            // Handle resource result
-                            if (deploymentResult.success && deploymentResult.deployedResource) {
-                                deployedResources.push(deploymentResult.deployedResource);
-                                successfulResources++;
-                            }
-                            else {
-                                levelHasFailures = true;
-                                failedResources++;
-                                if (deploymentResult.error) {
-                                    errors.push(deploymentResult.error);
-                                }
-                                if (deploymentResult.deployedResource) {
-                                    deployedResources.push(deploymentResult.deployedResource);
-                                }
-                            }
+                    else {
+                        levelHasFailures = true;
+                        failedClosures++;
+                        if (deploymentResult.error) {
+                            errors.push(deploymentResult.error);
                         }
                     }
+                }
+                else {
+                    // Handle resource result
+                    if (deploymentResult.success && deploymentResult.deployedResource) {
+                        deployedResources.push(deploymentResult.deployedResource);
+                        successfulResources++;
+                        await this.updateResourceKeyMappingWithLiveResource(deploymentResult.deployedResource, resourceKeyMapping, deploymentLogger);
+                    }
                     else {
                         levelHasFailures = true;
-                        levelLogger.error('Unexpected promise rejection in parallel deployment', result.reason);
+                        failedResources++;
+                        if (deploymentResult.error) {
+                            errors.push(deploymentResult.error);
+                        }
+                        if (deploymentResult.deployedResource) {
+                            deployedResources.push(deploymentResult.deployedResource);
+                        }
                     }
                 }
-                // Handle rollback if there are failures and rollback is enabled
-                if (levelHasFailures && options.rollbackOnFailure) {
-                    levelLogger.warn('Level deployment failed, initiating rollback');
-                    await this.rollbackDeployedResources(deployedResources, options);
-                    const duration = Date.now() - startTime;
-                    this.emitEvent(options, {
-                        type: 'rollback',
-                        message: `Deployment failed and rolled back in ${duration}ms`,
-                        timestamp: new Date(),
-                    });
-                    return {
-                        deploymentId,
-                        resources: deployedResources,
-                        dependencyGraph: graph.dependencyGraph,
-                        duration,
-                        status: 'failed',
-                        errors,
-                    };
-                }
-                // Calculate level performance metrics
-                const levelDuration = Date.now() - levelStartTime;
-                const totalOperations = currentLevel.resources.length + currentLevel.closures.length;
-                levelLogger.info(`Level ${levelIndex + 1} deployment completed`, {
-                    resources: { successful: successfulResources, failed: failedResources },
-                    closures: { successful: successfulClosures, failed: failedClosures },
-                    duration: levelDuration,
-                    parallelism: totalOperations,
-                    averageTimePerOperation: totalOperations > 0 ? Math.round(levelDuration / totalOperations) : 0,
-                });
             }
+            else {
+                levelHasFailures = true;
+                levelLogger.error('Unexpected promise rejection in parallel deployment', result.reason);
+            }
+        }
+        // Handle rollback if there are failures and rollback is enabled
+        if (levelHasFailures && options.rollbackOnFailure) {
+            levelLogger.warn('Level deployment failed, initiating rollback');
+            await this.rollbackDeployedResources(deployedResources, options);
             const duration = Date.now() - startTime;
-            const successfulResources = deployedResources.filter((r) => r.status !== 'failed');
-            const status = errors.length === 0 ? 'success' : successfulResources.length > 0 ? 'partial' : 'failed';
-            // Log comprehensive performance metrics
-            deploymentLogger.info('Parallel deployment with closures performance metrics', {
-                totalDuration: duration,
-                totalResources: enhancedPlan.totalResources,
-                totalClosures: enhancedPlan.totalClosures,
-                parallelLevels: enhancedPlan.levels.length,
-                maxParallelism: enhancedPlan.maxParallelism,
-                averageTimePerResource: enhancedPlan.totalResources > 0 ? Math.round(duration / enhancedPlan.totalResources) : 0,
-                successfulResources: successfulResources.length,
-                failedResources: errors.length,
-                status,
-            });
             this.emitEvent(options, {
-                type: status === 'success' ? 'completed' : 'failed',
-                message: `Deployment with closures ${status} in ${duration}ms (${enhancedPlan.totalClosures} closures + ${enhancedPlan.totalResources} resources across ${enhancedPlan.levels.length} levels)`,
+                type: 'rollback',
+                message: `Deployment failed and rolled back in ${duration}ms`,
                 timestamp: new Date(),
             });
-            // Store deployment state for rollback
-            this.deploymentState.set(deploymentId, {
-                deploymentId,
-                resources: deployedResources,
-                dependencyGraph: graph.dependencyGraph,
-                startTime: new Date(startTime),
-                endTime: new Date(),
-                status: status === 'success' ? 'completed' : status === 'partial' ? 'completed' : 'failed',
-                options,
-            });
             return {
                 deploymentId,
                 resources: deployedResources,
                 dependencyGraph: graph.dependencyGraph,
                 duration,
-                status,
+                status: 'failed',
                 errors,
             };
         }
-        catch (error) {
-            // Re-throw circular dependency errors immediately - these are configuration errors
-            if (error instanceof CircularDependencyError) {
-                throw error;
+        // Calculate level performance metrics
+        const levelDuration = Date.now() - levelStartTime;
+        const totalOperations = currentLevel.resources.length + currentLevel.closures.length;
+        levelLogger.info(`Level ${levelIndex + 1} deployment completed`, {
+            resources: { successful: successfulResources, failed: failedResources },
+            closures: { successful: successfulClosures, failed: failedClosures },
+            duration: levelDuration,
+            parallelism: totalOperations,
+            averageTimePerOperation: totalOperations > 0 ? Math.round(levelDuration / totalOperations) : 0,
+        });
+        return undefined;
+    }
+    /**
+     * Build the final DeploymentResult after all levels have been deployed.
+     * Logs comprehensive performance metrics and emits completion/failure events.
+     * @param deploymentId - Unique deployment ID
+     * @param graph - The deployment resource graph
+     * @param enhancedPlan - The enhanced deployment plan with closure information
+     * @param deployedResources - All deployed resources across all levels
+     * @param errors - All deployment errors across all levels
+     * @param startTime - Deployment start timestamp
+     * @param options - Deployment options for event emission
+     * @param deploymentLogger - Logger scoped to this deployment
+     * @returns The final deployment result
+     */
+    buildDeploymentResult(deploymentId, graph, enhancedPlan, deployedResources, errors, startTime, options, deploymentLogger) {
+        const duration = Date.now() - startTime;
+        const successfulResources = deployedResources.filter((r) => r.status !== 'failed');
+        const status = errors.length === 0 ? 'success' : successfulResources.length > 0 ? 'partial' : 'failed';
+        // Log comprehensive performance metrics
+        deploymentLogger.info('Parallel deployment with closures performance metrics', {
+            totalDuration: duration,
+            totalResources: enhancedPlan.totalResources,
+            totalClosures: enhancedPlan.totalClosures,
+            parallelLevels: enhancedPlan.levels.length,
+            maxParallelism: enhancedPlan.maxParallelism,
+            averageTimePerResource: enhancedPlan.totalResources > 0 ? Math.round(duration / enhancedPlan.totalResources) : 0,
+            successfulResources: successfulResources.length,
+            failedResources: errors.length,
+            status,
+        });
+        this.emitEvent(options, {
+            type: status === 'success' ? 'completed' : 'failed',
+            message: `Deployment with closures ${status} in ${duration}ms (${enhancedPlan.totalClosures} closures + ${enhancedPlan.totalResources} resources across ${enhancedPlan.levels.length} levels)`,
+            timestamp: new Date(),
+        });
+        return {
+            deploymentId,
+            resources: deployedResources,
+            dependencyGraph: graph.dependencyGraph,
+            duration,
+            status,
+            errors,
+        };
+    }
+    /**
+     * Stop event monitoring, clear the deployment timeout, and remove the
+     * abort controller from tracking. Safe to call multiple times.
+     * @param abortController - The deployment's AbortController to untrack
+     * @param timeoutId - The timeout ID to clear
+     * @param deploymentLogger - Logger scoped to this deployment
+     */
+    async cleanupDeployment(abortController, timeoutId, deploymentLogger) {
+        // Stop event monitoring
+        if (this.eventMonitor) {
+            try {
+                await this.eventMonitor.stopMonitoring();
+                deploymentLogger.debug('Event monitoring stopped');
             }
-            const duration = Date.now() - startTime;
-            this.emitEvent(options, {
-                type: 'failed',
-                message: `Deployment with closures failed: ${error}`,
-                timestamp: new Date(),
-                error: error,
+            catch (error) {
+                deploymentLogger.warn('Failed to stop event monitoring cleanly', {
+                    error: ensureError(error).message,
+                });
+            }
+        }
+        // Clean up abort controller and timeout
+        clearTimeout(timeoutId);
+        this.removeTrackedAbortController(abortController);
+    }
+    /**
+     * Update the resourceKeyMapping with a live resource fetched from the cluster.
+     * This is critical for CEL expression evaluation which needs access to resource status.
+     */
+    async updateResourceKeyMappingWithLiveResource(deployedRes, resourceKeyMapping, logger) {
+        const originalResourceId = getResourceMetadataId(deployedRes.manifest);
+        if (!originalResourceId || !resourceKeyMapping.has(originalResourceId)) {
+            return;
+        }
+        try {
+            const liveResource = await this.k8sApi.read({
+                apiVersion: deployedRes.manifest.apiVersion || '',
+                kind: deployedRes.kind,
+                metadata: {
+                    name: deployedRes.name,
+                    namespace: deployedRes.namespace,
+                },
             });
-            // Store deployment state even for failed deployments (for rollback)
-            this.deploymentState.set(deploymentId, {
-                deploymentId,
-                resources: deployedResources,
-                dependencyGraph: graph.dependencyGraph,
-                startTime: new Date(startTime),
-                endTime: new Date(),
-                status: 'failed',
-                options,
+            resourceKeyMapping.set(originalResourceId, liveResource);
+            logger.debug('Updated resourceKeyMapping with live resource status', {
+                originalResourceId,
+                kind: deployedRes.kind,
+                name: deployedRes.name,
+                hasStatus: !!liveResource.status,
+            });
+        }
+        catch (error) {
+            logger.warn('Failed to update resourceKeyMapping with live resource', {
+                originalResourceId,
+                error: ensureError(error).message,
             });
-            return {
-                deploymentId,
-                resources: deployedResources,
-                dependencyGraph: graph.dependencyGraph,
-                duration,
-                status: 'failed',
-                errors: [
-                    {
-                        resourceId: 'deployment',
-                        phase: 'deployment',
-                        error: error,
-                        timestamp: new Date(),
-                    },
-                ],
-            };
         }
-    } /**
-  
+    }
+    /**
      * Deploy a single resource
      */
-    async deploySingleResource(resource, context, options) {
-        const resourceId = resource.id || resource.__resourceId || resource.metadata?.name || 'unknown';
+    async deploySingleResource(resource, context, options, abortSignal) {
+        // Check if already aborted
+        if (abortSignal?.aborted) {
+            throw new DOMException('Operation aborted', 'AbortError');
+        }
+        // Resource ID from WeakMap metadata or deterministic ID generation
+        const internalId = getResourceMetadataId(resource);
+        const resourceId = internalId || getResourceId(resource);
         const resourceLogger = this.logger.child({
             resourceId,
             kind: resource.kind,
@@ -892,146 +777,11 @@ export class DirectDeploymentEngine {
             timestamp: new Date(),
         });
         // 1. Resolve all references in the resource
-        let resolvedResource;
-        try {
-            resourceLogger.debug('Resolving resource references', {
-                originalMetadata: resource.metadata,
-            });
-            const resolveTimeout = options.timeout || 30000;
-            resolvedResource = (await Promise.race([
-                this.referenceResolver.resolveReferences(resource, context),
-                new Promise((_, reject) => setTimeout(() => reject(new Error('Reference resolution timeout')), resolveTimeout)),
-            ]));
-            resourceLogger.debug('References resolved successfully', {
-                resolvedMetadata: resolvedResource.metadata,
-                hasReadinessEvaluator: !!resolvedResource.readinessEvaluator,
-            });
-        }
-        catch (error) {
-            resourceLogger.warn('Reference resolution failed, using original resource', error);
-            resolvedResource = resource;
-        }
+        const resolvedRef = await this.resourceApplier.resolveResourceReferences(resource, context, options, resourceLogger);
         // 2. Apply namespace if specified, but only if resource doesn't already have one
-        if (options.namespace &&
-            resolvedResource.metadata &&
-            typeof resolvedResource.metadata.namespace !== 'string') {
-            resourceLogger.debug('Applying namespace from deployment options', {
-                targetNamespace: options.namespace,
-                currentNamespace: resolvedResource.metadata.namespace,
-                currentNamespaceType: typeof resolvedResource.metadata.namespace,
-            });
-            // Create a completely new metadata object to avoid proxy issues
-            const newMetadata = {
-                ...resolvedResource.metadata,
-                namespace: options.namespace,
-            };
-            // Preserve the readiness evaluator when creating the new resource
-            const newResolvedResource = {
-                ...resolvedResource,
-                metadata: newMetadata,
-            };
-            // Copy the non-enumerable readiness evaluator if it exists
-            const readinessEvaluator = resolvedResource.readinessEvaluator;
-            if (readinessEvaluator) {
-                Object.defineProperty(newResolvedResource, 'readinessEvaluator', {
-                    value: readinessEvaluator,
-                    enumerable: false,
-                    configurable: true,
-                    writable: false,
-                });
-            }
-            resolvedResource = newResolvedResource;
-        }
+        const resolvedResource = this.resourceApplier.applyNamespaceToResource(resolvedRef, options.namespace, resourceLogger);
         // 3. Apply the resource to the cluster (or simulate for dry run)
-        let appliedResource;
-        if (options.dryRun) {
-            // In dry run mode, don't actually create the resource
-            resourceLogger.debug('Dry run mode: simulating resource creation');
-            appliedResource = {
-                ...resolvedResource,
-                metadata: {
-                    ...resolvedResource.metadata,
-                    uid: 'dry-run-uid',
-                },
-            };
-        }
-        else {
-            // Apply resource with retry logic
-            const retryPolicy = options.retryPolicy || {
-                maxRetries: 3,
-                backoffMultiplier: 2,
-                initialDelay: 1000,
-                maxDelay: 30000,
-            };
-            let lastError;
-            for (let attempt = 0; attempt <= retryPolicy.maxRetries; attempt++) {
-                try {
-                    resourceLogger.debug('Applying resource to cluster', { attempt });
-                    // Check if resource already exists
-                    let existing;
-                    try {
-                        const readResult = await this.k8sApi.read({
-                            apiVersion: resolvedResource.apiVersion,
-                            kind: resolvedResource.kind,
-                            metadata: {
-                                name: resolvedResource.metadata?.name || '',
-                                namespace: resolvedResource.metadata?.namespace || 'default',
-                            },
-                        });
-                        existing = readResult.body;
-                    }
-                    catch (error) {
-                        // If it's a 404, the resource doesn't exist, which is expected for creation
-                        if (error.statusCode !== 404) {
-                            resourceLogger.error('Error checking resource existence', error);
-                            throw error;
-                        }
-                    }
-                    if (existing) {
-                        // Resource exists, use patch for safer updates
-                        resourceLogger.debug('Resource exists, patching');
-                        const patchResult = await this.patchResourceWithCorrectContentType(resolvedResource);
-                        appliedResource = patchResult.body;
-                    }
-                    else {
-                        // Resource does not exist, create it
-                        resourceLogger.debug('Resource does not exist, creating');
-                        const createResult = await this.k8sApi.create(resolvedResource);
-                        appliedResource = createResult.body;
-                    }
-                    resourceLogger.debug('Resource applied successfully', {
-                        appliedName: appliedResource.metadata?.name,
-                        appliedNamespace: appliedResource.metadata?.namespace,
-                        operation: existing ? 'patched' : 'created',
-                        attempt,
-                    });
-                    // Success - break out of retry loop
-                    break;
-                }
-                catch (error) {
-                    lastError = error;
-                    resourceLogger.error('Failed to apply resource to cluster', lastError, { attempt });
-                    // Check for HTTP 415 Unsupported Media Type errors
-                    if (this.isUnsupportedMediaTypeError(error)) {
-                        const acceptedTypes = this.extractAcceptedMediaTypes(error);
-                        throw new UnsupportedMediaTypeError(resolvedResource.metadata?.name || 'unknown', resolvedResource.kind || 'Unknown', acceptedTypes, lastError);
-                    }
-                    // If this was the last attempt, throw the error
-                    if (attempt >= retryPolicy.maxRetries) {
-                        throw new ResourceDeploymentError(resolvedResource.metadata?.name || 'unknown', resolvedResource.kind || 'Unknown', lastError);
-                    }
-                    // Calculate delay for next attempt
-                    const delay = Math.min(retryPolicy.initialDelay * retryPolicy.backoffMultiplier ** attempt, retryPolicy.maxDelay);
-                    resourceLogger.debug('Retrying resource deployment', {
-                        attempt: attempt + 1,
-                        maxRetries: retryPolicy.maxRetries,
-                        delay,
-                    });
-                    // Wait before retrying
-                    await new Promise((resolve) => setTimeout(resolve, delay));
-                }
-            }
-        }
+        await this.resourceApplier.applyResourceToCluster(resolvedResource, options, resourceLogger);
         // 4. Create deployed resource record
         const deployedResource = {
             id: resourceId,
@@ -1045,7 +795,7 @@ export class DirectDeploymentEngine {
         // 5. Wait for resource to be ready if requested
         if (options.waitForReady !== false) {
             resourceLogger.debug('Waiting for resource to be ready');
-            await this.waitForResourceReady(deployedResource, options);
+            await this.waitForResourceReady(deployedResource, options, abortSignal);
             deployedResource.status = 'ready';
         }
         resourceLogger.debug('Single resource deployment completed');
@@ -1053,145 +803,24 @@ export class DirectDeploymentEngine {
     }
     /**
      * Wait for a resource to be ready
+     * @param deployedResource - The deployed resource to wait for
+     * @param options - Deployment options
+     * @param abortSignal - Optional AbortSignal to cancel the wait
      */
-    async waitForResourceReady(deployedResource, options) {
-        const resourceKey = `${deployedResource.kind}/${deployedResource.name}/${deployedResource.namespace}`;
-        // Check if already marked as ready
-        if (deployedResource.status === 'ready' || this.readyResources.has(resourceKey)) {
-            this.logger.debug('Resource already marked as ready', { resourceKey });
-            return;
-        }
-        // Safety-first approach: check for readiness evaluator before starting the wait loop
-        const readinessEvaluator = deployedResource.manifest.readinessEvaluator;
-        // Debug logging removed
-        if (!readinessEvaluator) {
-            const errorMessage = `Resource ${deployedResource.kind}/${deployedResource.name} does not have a factory-provided readiness evaluator`;
-            this.logger.error('Missing factory-provided readiness evaluator');
-            throw new Error(errorMessage);
-        }
-        const startTime = Date.now();
-        const timeout = options.timeout || 300000; // 5 minutes default
-        let lastStatus = null;
-        while (Date.now() - startTime < timeout) {
-            try {
-                // Use custom readiness evaluator
-                const { body: liveResource } = await this.k8sApi.read({
-                    apiVersion: deployedResource.manifest.apiVersion || '',
-                    kind: deployedResource.kind,
-                    metadata: {
-                        name: deployedResource.name,
-                        namespace: deployedResource.namespace,
-                    },
-                });
-                const result = readinessEvaluator(liveResource);
-                if (typeof result === 'boolean') {
-                    if (result) {
-                        this.readyResources.add(resourceKey);
-                        this.emitEvent(options, {
-                            type: 'resource-ready',
-                            resourceId: deployedResource.id,
-                            message: `${deployedResource.kind}/${deployedResource.name} ready (custom evaluator)`,
-                            timestamp: new Date(),
-                        });
-                        return;
-                    }
-                }
-                else if (result && typeof result === 'object' && 'ready' in result) {
-                    lastStatus = result;
-                    if (result.ready) {
-                        this.readyResources.add(resourceKey);
-                        this.emitEvent(options, {
-                            type: 'resource-ready',
-                            resourceId: deployedResource.id,
-                            message: result.message ||
-                                `${deployedResource.kind}/${deployedResource.name} ready (custom evaluator)`,
-                            timestamp: new Date(),
-                        });
-                        return;
-                    }
-                }
-                // Emit status update if we have status information
-                if (lastStatus && typeof lastStatus === 'object' && 'message' in lastStatus) {
-                    this.emitEvent(options, {
-                        type: 'resource-status',
-                        resourceId: deployedResource.id,
-                        message: `${deployedResource.kind}/${deployedResource.name}: ${lastStatus.message}`,
-                        timestamp: new Date(),
-                    });
-                }
-                // Wait before next check
-                await new Promise((resolve) => setTimeout(resolve, 2000));
-            }
-            catch (error) {
-                // Emit error status event
-                this.emitEvent(options, {
-                    type: 'resource-status',
-                    resourceId: deployedResource.id,
-                    message: `Unable to read resource status: ${error instanceof Error ? error.message : String(error)}`,
-                    timestamp: new Date(),
-                });
-                // If we can't read the resource, it's not ready yet
-                await new Promise((resolve) => setTimeout(resolve, 2000));
-            }
-        }
-        // Timeout reached
-        const timeoutMessage = lastStatus
-            ? `Timeout waiting for ${deployedResource.kind}/${deployedResource.name}: ${lastStatus.message}`
-            : `Timeout waiting for ${deployedResource.kind}/${deployedResource.name} to be ready`;
-        throw new Error(timeoutMessage);
+    async waitForResourceReady(deployedResource, options, abortSignal) {
+        return this.readinessWaiter.waitForResourceReady(deployedResource, options, abortSignal);
     }
     /**
      * Rollback deployed resources
      */
     async rollbackDeployedResources(deployedResources, options) {
-        this.emitEvent(options, {
-            type: 'rollback',
-            message: 'Starting rollback of deployed resources',
-            timestamp: new Date(),
-        });
-        const rolledBackResources = [];
-        const errors = [];
-        // Rollback in reverse order
-        const reversedResources = [...deployedResources].reverse();
-        for (const resource of reversedResources) {
-            // Only try to rollback resources that were actually deployed (not failed)
-            if (resource.status === 'failed') {
-                continue; // Skip resources that failed to deploy
-            }
-            try {
-                await this.k8sApi.delete({
-                    apiVersion: resource.manifest.apiVersion || '',
-                    kind: resource.kind,
-                    metadata: {
-                        name: resource.name,
-                        namespace: resource.namespace,
-                    },
-                });
-                rolledBackResources.push(`${resource.kind}/${resource.name}`);
-            }
-            catch (error) {
-                // Log and collect errors for individual resource deletion failures
-                this.logger.warn('Failed to delete resource during rollback', {
-                    error: error,
-                    resourceId: resource.id,
-                    kind: resource.kind,
-                    name: resource.name,
-                });
-                errors.push({
-                    resourceId: resource.id,
-                    phase: 'rollback',
-                    error: error,
-                    timestamp: new Date(),
-                });
-            }
-        }
-        return { rolledBackResources, errors };
+        return this.rollbackManager.rollbackDeployedResources(deployedResources, options);
     }
     /**
      * Generate a unique deployment ID
      */
     generateDeploymentId() {
-        return `deployment-${Date.now()}-${Math.random().toString(36).substr(2, 9)}`;
+        return `deployment-${Date.now()}-${Math.random().toString(36).substring(2, 11)}`;
     }
     /**
      * Emit deployment events
@@ -1209,65 +838,16 @@ export class DirectDeploymentEngine {
             deployedResources: [],
             kubeClient: this.kubeClient,
             ...(options.namespace && { namespace: options.namespace }),
-            timeout: options.timeout || 30000,
+            timeout: options.timeout || DEFAULT_READINESS_TIMEOUT,
         };
-        return this.deploySingleResource(resource, context, options);
+        // Legacy method - no abort signal support
+        return this.deploySingleResource(resource, context, options, undefined);
     }
     /**
      * Delete a resource from the cluster
      */
     async deleteResource(resource) {
-        const deleteLogger = this.logger.child({
-            resourceId: resource.id,
-            kind: resource.kind,
-            name: resource.name,
-        });
-        try {
-            await this.k8sApi.delete({
-                apiVersion: resource.manifest.apiVersion || '',
-                kind: resource.kind,
-                metadata: {
-                    name: resource.name,
-                    namespace: resource.namespace,
-                },
-            });
-            // Wait for resource to be deleted
-            const timeout = 30000; // 30 seconds
-            const startTime = Date.now();
-            while (Date.now() - startTime < timeout) {
-                try {
-                    await this.k8sApi.read({
-                        apiVersion: resource.manifest.apiVersion || '',
-                        kind: resource.kind,
-                        metadata: {
-                            name: resource.name,
-                            namespace: resource.namespace,
-                        },
-                    });
-                    // Resource still exists, wait and try again
-                    await new Promise((resolve) => setTimeout(resolve, 1000));
-                }
-                catch (error) {
-                    // Resource not found, deletion successful
-                    if (this.isNotFoundError(error)) {
-                        deleteLogger.debug('Resource successfully deleted');
-                        return;
-                    }
-                    throw error;
-                }
-            }
-            throw new Error(`Timeout waiting for resource ${resource.kind}/${resource.name} to be deleted`);
-        }
-        catch (error) {
-            deleteLogger.error('Failed to delete resource', error);
-            throw error;
-        }
-    }
-    /**
-     * Wait for resource readiness (legacy method for compatibility)
-     */
-    async waitForResourceReadiness(resource, options) {
-        return this.waitForResourceReady(resource, options);
+        return this.rollbackManager.deleteDeployedResource(resource);
     }
     /**
      * Rollback a deployment by ID
@@ -1276,7 +856,7 @@ export class DirectDeploymentEngine {
         const startTime = Date.now();
         const deploymentRecord = this.deploymentState.get(deploymentId);
         if (!deploymentRecord) {
-            throw new Error(`Deployment ${deploymentId} not found. Cannot rollback.`);
+            throw new ResourceGraphFactoryError(`Deployment ${deploymentId} not found. Cannot rollback.`, deploymentId, 'cleanup');
         }
         try {
             const { rolledBackResources, errors } = await this.rollbackDeployedResources(deploymentRecord.resources, deploymentRecord.options);
@@ -1300,7 +880,7 @@ export class DirectDeploymentEngine {
                     {
                         resourceId: deploymentId,
                         phase: 'rollback',
-                        error: error,
+                        error: ensureError(error),
                         timestamp: new Date(),
                     },
                 ],
@@ -1336,207 +916,11 @@ export class DirectDeploymentEngine {
         }
         return result;
     }
-    /**
-     * Patch a resource with the correct Content-Type header for merge patch operations
-     * This fixes HTTP 415 "Unsupported Media Type" errors that occur when using the generic patch method
-     */
-    async patchResourceWithCorrectContentType(resource) {
-        // The k8sApi.patch method already includes the correct Content-Type header for merge patch operations
-        // This was fixed in the deployment engine to use 'application/merge-patch+json'
-        return await this.k8sApi.patch(resource, undefined, undefined, undefined, undefined, {
-            headers: {
-                'Content-Type': 'application/merge-patch+json'
-            }
-        });
-    }
-    /**
-     * Check if an error is a "not found" error
-     */
-    isNotFoundError(error) {
-        if (error && typeof error === 'object') {
-            const k8sError = error;
-            return k8sError.statusCode === 404 || k8sError.body?.code === 404;
-        }
-        return false;
-    }
-    /**
-     * Wait for CRD establishment if the resource is a custom resource
-     */
-    async waitForCRDIfCustomResource(resource, options, logger) {
-        // Skip if this is not a custom resource
-        if (!this.isCustomResource(resource)) {
-            return;
-        }
-        const crdName = await this.getCRDNameForResource(resource);
-        if (!crdName) {
-            logger.warn('Could not determine CRD name for custom resource', {
-                kind: resource.kind,
-                apiVersion: resource.apiVersion,
-            });
-            return;
-        }
-        logger.debug('Custom resource detected, waiting for CRD establishment', {
-            resourceKind: resource.kind,
-            crdName,
-        });
-        await this.waitForCRDEstablishment({ metadata: { name: crdName } }, options, logger);
-        logger.debug('CRD established, proceeding with custom resource deployment', {
-            resourceKind: resource.kind,
-            crdName,
-        });
-    }
-    /**
-     * Check if a resource is a custom resource (not a built-in Kubernetes resource)
-     */
-    isCustomResource(resource) {
-        if (!resource.apiVersion || !resource.kind) {
-            return false;
-        }
-        // Built-in Kubernetes API groups that are NOT custom resources
-        const builtInApiGroups = [
-            'v1', // Core API group
-            'apps/v1',
-            'extensions/v1beta1',
-            'networking.k8s.io/v1',
-            'policy/v1',
-            'rbac.authorization.k8s.io/v1',
-            'storage.k8s.io/v1',
-            'apiextensions.k8s.io/v1', // CRDs themselves
-            'admissionregistration.k8s.io/v1',
-            'apiregistration.k8s.io/v1',
-            'authentication.k8s.io/v1',
-            'authorization.k8s.io/v1',
-            'autoscaling/v1',
-            'autoscaling/v2',
-            'batch/v1',
-            'certificates.k8s.io/v1',
-            'coordination.k8s.io/v1',
-            'discovery.k8s.io/v1',
-            'events.k8s.io/v1',
-            'flowcontrol.apiserver.k8s.io/v1beta3',
-            'node.k8s.io/v1',
-            'scheduling.k8s.io/v1',
-        ];
-        return !builtInApiGroups.includes(resource.apiVersion);
-    }
-    /**
-     * Get the CRD name for a custom resource
-     */
-    async getCRDNameForResource(resource) {
-        if (!resource.apiVersion || !resource.kind) {
-            return null;
-        }
-        // Only return CRD name for custom resources
-        if (!this.isCustomResource(resource)) {
-            return null;
-        }
-        // Extract group from apiVersion (e.g., "example.com/v1" -> "example.com")
-        const apiVersionParts = resource.apiVersion.split('/');
-        const group = apiVersionParts.length > 1 ? apiVersionParts[0] : '';
-        if (!group) {
-            return null; // Core API resources don't have CRDs
-        }
-        try {
-            // Try to find the CRD by querying the API
-            const crds = await this.k8sApi.list('apiextensions.k8s.io/v1', 'CustomResourceDefinition');
-            // Look for a CRD that matches our group and kind
-            const matchingCrd = crds.body?.items?.find((crd) => {
-                const crdSpec = crd.spec;
-                return crdSpec?.group === group && crdSpec?.names?.kind === resource.kind;
-            });
-            if (matchingCrd) {
-                return matchingCrd.metadata?.name;
-            }
-        }
-        catch (error) {
-            // If we can't query CRDs, fall back to heuristic
-            console.warn('Failed to query CRDs, using heuristic for CRD name generation:', error);
-        }
-        // Fallback: Convert Kind to plural lowercase (simple heuristic)
-        const kind = resource.kind.toLowerCase();
-        const plural = kind.endsWith('s') ? kind : `${kind}s`;
-        return `${plural}.${group}`;
-    }
     /**
      * Public method to wait for CRD readiness by name
      */
-    async waitForCRDReady(crdName, timeout = 300000) {
-        const logger = this.logger.child({ crdName, timeout });
-        const options = {
-            mode: this.deploymentMode,
-            timeout,
-        };
-        await this.waitForCRDEstablishment({ metadata: { name: crdName } }, options, logger);
-    }
-    /**
-     * Wait for a CRD to be established in the cluster
-     */
-    async waitForCRDEstablishment(crd, options, logger) {
-        const crdName = crd.metadata?.name;
-        const timeout = options.timeout || 300000; // 5 minutes default
-        const startTime = Date.now();
-        const pollInterval = 2000; // 2 seconds
-        logger.debug('Waiting for CRD to exist and be established', { crdName, timeout });
-        while (Date.now() - startTime < timeout) {
-            try {
-                // Check if CRD is established by reading its status
-                const crdStatus = await this.k8sApi.read({
-                    apiVersion: 'apiextensions.k8s.io/v1',
-                    kind: 'CustomResourceDefinition',
-                    metadata: { name: crdName }, // CRDs are cluster-scoped, no namespace needed
-                });
-                const conditions = crdStatus.body?.status?.conditions || [];
-                const establishedCondition = conditions.find((c) => c.type === 'Established');
-                if (establishedCondition?.status === 'True') {
-                    logger.debug('CRD exists and is established', { crdName });
-                    return;
-                }
-                logger.debug('CRD exists but not yet established, waiting...', {
-                    crdName,
-                    establishedStatus: establishedCondition?.status || 'unknown',
-                });
-            }
-            catch (error) {
-                // CRD might not exist yet (e.g., being installed by a closure)
-                // This is expected in scenarios where closures install CRDs
-                logger.debug('CRD not found yet, waiting for it to be created...', {
-                    crdName,
-                    error: error.message,
-                });
-            }
-            // Wait before next poll
-            await new Promise((resolve) => setTimeout(resolve, pollInterval));
-        }
-        // Timeout reached
-        throw new Error(`Timeout waiting for CRD ${crdName} to be established after ${timeout}ms`);
-    }
-    /**
-     * Check if an error is an HTTP 415 Unsupported Media Type error
-     */
-    isUnsupportedMediaTypeError(error) {
-        return (error &&
-            typeof error === 'object' &&
-            (error.statusCode === 415 ||
-                (error.response && error.response.statusCode === 415) ||
-                (error.body && error.body.code === 415)));
-    }
-    /**
-     * Extract accepted media types from HTTP 415 error message
-     */
-    extractAcceptedMediaTypes(error) {
-        const defaultTypes = ['application/json-patch+json', 'application/merge-patch+json', 'application/apply-patch+yaml'];
-        try {
-            // Try to extract from error message
-            const message = error.message || error.body?.message || '';
-            const match = message.match(/accepted media types include: ([^"]+)/);
-            if (match && match[1]) {
-                return match[1].split(', ').map((type) => type.trim());
-            }
-        }
-        catch (_e) {
-            // Fallback to default types
-        }
-        return defaultTypes;
+    async waitForCRDReady(crdName, timeout = DEFAULT_CRD_READY_TIMEOUT, abortSignal) {
+        await this.crdManager.waitForCRDReady(crdName, this.deploymentMode, timeout, abortSignal);
     }
 }
 //# sourceMappingURL=engine.js.map