typekro 0.34.0 → 0.36.0

package/dist/core/deployment/kro-readiness.js

@@ -10,9 +10,10 @@
  * - Custom status fields populated from the RGD status schema
  */
 import { DEFAULT_FAST_POLL_INTERVAL, DEFAULT_HTTP_READ_TIMEOUT, DEFAULT_POLL_INTERVAL, } from '../config/defaults.js';
-import { CRDInstanceError, DeploymentTimeoutError, ensureError } from '../errors.js';
+import { CRDInstanceError, DeploymentTimeoutError } from '../errors.js';
 import { getComponentLogger } from '../logging/index.js';
-import { callWithTimeout, PollTimeoutError, perCallTimeout } from './poll-timeout.js';
+import { classifyReadError } from './k8s-helpers.js';
+import { callWithTimeout, perCallTimeout } from './poll-timeout.js';
 function abortableDelay(ms, abortSignal) {
     abortSignal?.throwIfAborted();
     if (!abortSignal)
@@ -29,6 +30,23 @@ function abortableDelay(ms, abortSignal) {
         abortSignal.addEventListener('abort', onAbort, { once: true });
     });
 }
+/**
+ * Sleep between polls WITHOUT overshooting the caller's deadline.
+ *
+ * A bare `abortableDelay(pollInterval)` can carry the wait up to a full poll interval PAST the
+ * declared `timeout` — a 5s budget polled every 2s could return at 7s — because the `while`
+ * condition is only re-checked after the sleep has already run to completion. Capping the sleep to
+ * whatever is left of the budget keeps the declared timeout the real upper bound, so a caller that
+ * sizes a deploy against it is not silently given more time than it asked for.
+ *
+ * @returns `false` when the budget is already spent, meaning the caller should stop polling.
+ */
+async function delayWithinBudget(ms, remaining, abortSignal) {
+    if (remaining <= 0)
+        return false;
+    await abortableDelay(Math.min(ms, remaining), abortSignal);
+    return true;
+}
 /**
  * Wait for a Kro custom resource instance to become ready.
  *
@@ -38,6 +56,41 @@ function abortableDelay(ms, abortSignal) {
  *    and has observed the current instance generation when KRO reports generations
  * 3. Either custom status fields are populated OR the RGD declares no status schema
  *
+ * A TERMINAL instance state (`FAILED`/`ERROR`) is checked first, on the instance read alone, before
+ * the RGD lookup below, and only when the failure evidence belongs to the CURRENT
+ * `metadata.generation` — Kubernetes keeps the status subresource across spec updates, so on an
+ * update the previous deployment's verdict can still be on the object while the new generation is
+ * about to reconcile. A current terminal state carries the most actionable message this function can
+ * return and must not be buried behind lookup retries; a stale one is history and falls through to
+ * normal polling, still bounded by the overall deadline.
+ *
+ * RGD STATUS-SCHEMA LOOKUP POLICY. Step 3 needs the ResourceGraphDefinition's declared status schema.
+ * An UNCERTAIN read of that schema is never converted into an EMPTY schema: "we did not learn what
+ * this instance's status should contain" must not become "this instance has no custom status", which
+ * is what declares an ACTIVE/synced instance ready without validating any of its expected fields.
+ * Being uncertain is not, however, a reason to retry forever. Failures are classified with the
+ * repo's shared retry policy, {@link classifyReadError}:
+ *
+ * - RETRYABLE — `object-not-found` (the RGD is missing or not yet created) and `transient` (5xx,
+ *   rate limiting, a wedged request, a dropped socket, a DNS blip) — ABANDONS the iteration: neither
+ *   ready nor permissive. The loop polls again, so the caller's overall `timeout` stays the single
+ *   authority on how long to keep trying, and one blip is ridden out rather than failing the deploy.
+ *   A lookup that never succeeds simply never satisfies step 3, and the wait ends in the overall
+ *   {@link DeploymentTimeoutError}, whose message carries the last lookup failure so the diagnosis
+ *   is not lost.
+ * - DETERMINISTIC — `permission-denied` (401/403), `unknown-resource-type` (the RGD API resource is
+ *   not served), `invalid-request` (400/405/422), `tls-configuration-error` (an expired, self-signed
+ *   or misnamed server certificate, an untrusted CA) and `not-a-kubernetes-error` (a `TypeError`
+ *   from a programming bug, a client signature mismatch) — FAILS FAST with the original error. Each reads
+ *   identically on every attempt, so polling it only spends the budget and then reports a timeout
+ *   that hides the real cause. RBAC is the canonical member: every other 401/403 in this codebase,
+ *   including the instance read in this same loop, already fails fast.
+ *
+ * `object-not-found` is strict rather than permissive for the same reason the whole policy is: the
+ * RGD name this poll looks up is the name the compiler emitted
+ * (`convertToKubernetesName(composition.name)`, threaded through the deployment plan), so a 404
+ * means the RGD is missing or not yet created, not that the instance has no status schema.
+ *
  * @throws {CRDInstanceError} if the instance enters a FAILED or ERROR state
  * @throws {DeploymentTimeoutError} if the timeout is exceeded
  */
@@ -46,8 +99,32 @@ export async function waitForKroInstanceReady(options) {
     const logger = getComponentLogger('kro-readiness');
     const readinessLogger = logger.child({ instanceName, rgdName });
     const startTime = Date.now();
+    /**
+     * The last RGD status-schema lookup that failed and was retried, as `classifyReadError`'s
+     * Kubernetes-aware `detail`. Folded into the overall timeout message: without it a persistently
+     * wedged lookup reports only "not ready in time" and the actionable diagnosis (a wedged request /
+     * a premature close, and its cause) is lost.
+     *
+     * The DETAIL rather than `ensureError(error).message`, because the client surfaces a Status-shaped
+     * rejection as a bare object: `ensureError({ statusCode: 503, body: { message: … } })` stringifies
+     * to `[object Object]`, which would put exactly that in the deadline diagnosis. `detail` falls
+     * back through the Status body and the formatted API error instead.
+     */
+    let lastLookupDetail;
+    /** The error object behind {@link lastLookupDetail}, attached to the deadline error as its cause. */
+    let lastLookupCause;
+    /** Lookup failure messages already logged, so a retry loop warns once per distinct message. */
+    const warnedLookupFailures = new Set();
     while (Date.now() - startTime < timeout) {
         abortSignal?.throwIfAborted();
+        /**
+         * Set immediately before the RGD status-schema lookup re-throws a DETERMINISTIC failure, so the
+         * catch below lets it out. That catch's job is to swallow a 404 on the INSTANCE read ("not
+         * created yet, keep waiting"); without this flag it would also swallow the lookup's own
+         * fail-fast 404 — the one that means the ResourceGraphDefinition API resource is not served at
+         * all — and poll to the deadline on an error that can never change.
+         */
+        let fatalLookupError = false;
         try {
             // Bound the read so a wedged/expired kubeconfig exec credential rejects (and is re-thrown below)
             // instead of hanging the poll forever — see poll-timeout.ts. A ≤0 budget means the deadline is
@@ -69,15 +146,59 @@ export async function waitForKroInstanceReady(options) {
             const status = instance.status;
             if (!status) {
                 readinessLogger.debug('No status found yet, continuing to wait', { instanceName });
-                await abortableDelay(DEFAULT_POLL_INTERVAL, abortSignal);
+                if (!(await delayWithinBudget(DEFAULT_POLL_INTERVAL, timeout - (Date.now() - startTime), abortSignal))) {
+                    break;
+                }
                 continue;
             }
             const state = status.state;
             const conditions = status.conditions || [];
+            const generation = instance.metadata?.generation;
+            // TERMINAL STATE IS CHECKED FIRST, BEFORE ANY RGD LOOKUP — BUT ONLY WHEN IT IS CURRENT.
+            //
+            // Kro v0.8.x uses "ERROR", v0.3.x uses "FAILED". Either way the instance is done: no amount of
+            // further polling changes it, and the condition message is the single most actionable thing
+            // this function can hand the caller. The check therefore runs on the instance read alone —
+            // the RGD status-schema lookup below cannot make a failed instance succeed, and under the
+            // strict lookup policy (every non-retryable failure fails fast, everything else retries) a
+            // lookup that is itself broken would otherwise bury this message behind retries until the
+            // deadline, turning a precise CRDInstanceError into a generic DeploymentTimeoutError.
+            //
+            // GENERATION AWARENESS. Kubernetes keeps the status subresource across spec updates, so on an
+            // UPDATE the very first read can legitimately return `generation: 7` alongside the PREVIOUS
+            // deployment's verdict — `state: FAILED`, `Ready=False` with `observedGeneration: 6` and that
+            // deployment's message — while generation 7 is about to reconcile perfectly well. KRO
+            // documents `observedGeneration < metadata.generation` as "not yet processed", so a terminal
+            // state is only authoritative when the failure evidence is current: a `False` condition that
+            // has observed this generation. Absent that evidence the state is stale history; it falls
+            // through to normal polling and the outer deadline still bounds the wait.
+            //
+            // Backward compatible by construction: an instance with no `metadata.generation`, or
+            // conditions from an older KRO that carry no `observedGeneration` at all, has no way to be
+            // stale, so the terminal state stays authoritative exactly as before.
+            if (state === 'FAILED' || state === 'ERROR') {
+                const failedCondition = conditions.find((c) => c.status === 'False' &&
+                    (generation === undefined ||
+                        c.observedGeneration === undefined ||
+                        c.observedGeneration >= generation));
+                const hasGenerationAwareConditions = conditions.some((c) => c.observedGeneration !== undefined);
+                const terminalStateIsCurrent = failedCondition !== undefined ||
+                    generation === undefined ||
+                    !hasGenerationAwareConditions;
+                if (terminalStateIsCurrent) {
+                    const errorMessage = failedCondition?.message || 'Unknown error';
+                    throw new CRDInstanceError(`Kro instance deployment failed (state=${state}): ${errorMessage}`, apiVersion, kind, instanceName, 'creation');
+                }
+                readinessLogger.debug('Terminal state belongs to an earlier generation — treating it as stale and continuing to poll', {
+                    instanceName,
+                    state,
+                    generation,
+                    conditionObservedGenerations: conditions.map((c) => c.observedGeneration),
+                });
+            }
             // Support both Kro v0.3.x (InstanceSynced) and v0.8.x (Ready) conditions
             const syncedCondition = conditions.find((c) => c.type === 'InstanceSynced');
             const readyCondition = conditions.find((c) => c.type === 'Ready');
-            const generation = instance.metadata?.generation;
             const conditionIsCurrent = (condition) => condition?.status === 'True' &&
                 (generation === undefined ||
                     condition.observedGeneration === undefined ||
@@ -107,6 +228,11 @@ export async function waitForKroInstanceReady(options) {
                 const rgdStatusSchema = rgd.spec?.schema?.status ?? {};
                 expectedStatusKeys = Object.keys(rgdStatusSchema).filter((key) => !basicKroFields.includes(key));
                 expectedCustomStatusFields = expectedStatusKeys.length > 0;
+                // The schema HAS now been read, so any earlier failure is spent history. Leaving it set
+                // would misattribute a later timeout — one caused by the projected status never becoming
+                // ready — to a lookup that has since been answered.
+                lastLookupDetail = undefined;
+                lastLookupCause = undefined;
                 readinessLogger.debug('ResourceGraphDefinition status schema check', {
                     rgdName,
                     rgdStatusKeys: expectedStatusKeys,
@@ -114,19 +240,60 @@ export async function waitForKroInstanceReady(options) {
                 });
             }
             catch (error) {
-                // A per-call TIMEOUT (wedged/expired credential) is NOT a fetchable-RGD failure — do not fall
-                // through to the permissive path, which would let an ACTIVE/synced instance be declared ready
-                // WITHOUT validating expected status fields (and after the deadline). Surface it so the outer
-                // catch re-throws it (fail fast).
-                if (error instanceof PollTimeoutError) {
+                // An UNCERTAIN read must never be converted into an empty schema. The old code fell through
+                // to `expectedCustomStatusFields = false` — "the RGD declares no custom status" — for every
+                // failure alike, so any request that did not produce an answer let an ACTIVE/synced instance
+                // be declared ready WITHOUT validating the status fields it was supposed to have. The
+                // question is not which error class this is, it is whether the server actually ANSWERED.
+                //
+                // WHAT IT IS NOT is a reason to retry FOREVER. Retrying every failure alike — which is what
+                // "fail fast only on forbidden" amounted to — spends the entire readiness budget on errors
+                // that will read identically on every attempt (an HTTP 400/405/422, a client signature
+                // mismatch, a plain `TypeError` from a programming bug) and then reports a
+                // DeploymentTimeoutError that HIDES them. `classifyReadError` is the file-local retry
+                // policy this repo already applies to the same question elsewhere (see the external-
+                // reference read in `engine.ts`), so use it here rather than growing a second one:
+                // object-not-found and transient retry; unknown-resource-type, permission-denied,
+                // invalid-request and not-a-kubernetes-error fail fast with the REAL error.
+                //
+                // It is used ALONE, with no local carve-out, because it now recognises the timeout and
+                // transport shapes this loop depends on: a bare `RequestTimeoutError` from the socket timer,
+                // a `PollTimeoutError` from the deadline wrapper and a `PrematureCloseError` from a
+                // mid-response disconnect all classify as `transient` (see `classifyReadErrorKind`). One
+                // classifier, one taxonomy — a carve-out here would have to be kept in sync with it forever.
+                const assessment = classifyReadError(error);
+                if (!assessment.retryable) {
+                    // RBAC (401/403) is the canonical case — the repo fails fast on it everywhere else,
+                    // including the instance read in this very loop — but a malformed request or a kind the
+                    // cluster does not serve is just as fixed. Waiting cannot change any of them.
+                    fatalLookupError = true;
                     throw error;
                 }
-                readinessLogger.warn('Could not fetch ResourceGraphDefinition for status schema check', {
-                    rgdName,
-                    error: ensureError(error).message,
-                });
-                // If we can't fetch the RGD, be permissive: if instance is ACTIVE and synced, consider it ready
-                expectedCustomStatusFields = false;
+                // Retryable: an absent RGD (404 for the object) or a transient fault (5xx, rate limiting, a
+                // wedged request, a dropped socket). We did not learn the schema, so abandon this iteration
+                // — neither ready nor permissive — and poll again, leaving the caller's overall `timeout`
+                // as the single authority on how long to keep trying. One transient blip is what a poll
+                // loop exists to ride out; a persistent failure ends in the overall DeploymentTimeoutError,
+                // carrying this message.
+                lastLookupDetail = assessment.detail;
+                // Keep the ORIGINAL thrown value, not an `ensureError` coercion: a bare Kubernetes `Status`
+                // object would coerce to `Error('[object Object]')` and lose `statusCode` / `body` for callers.
+                lastLookupCause = error;
+                if (!warnedLookupFailures.has(lastLookupDetail)) {
+                    warnedLookupFailures.add(lastLookupDetail);
+                    readinessLogger.warn('ResourceGraphDefinition status-schema lookup did not produce an answer — retrying until the readiness deadline', {
+                        rgdName,
+                        classification: assessment.classification,
+                        reason: assessment.summary,
+                        error: lastLookupDetail,
+                    });
+                }
+                // Honour the poll interval before retrying: a premature close can reject in milliseconds,
+                // so continuing straight to the top of the loop would spin.
+                if (!(await delayWithinBudget(pollInterval, timeout - (Date.now() - startTime), abortSignal))) {
+                    break;
+                }
+                continue;
             }
             readinessLogger.debug('Kro instance status check', {
                 instanceName,
@@ -177,12 +344,6 @@ export async function waitForKroInstanceReady(options) {
                 });
                 return;
             }
-            // Check for failure states (Kro v0.8.x uses "ERROR", v0.3.x uses "FAILED")
-            if (state === 'FAILED' || state === 'ERROR') {
-                const failedCondition = conditions.find((c) => c.status === 'False');
-                const errorMessage = failedCondition?.message || 'Unknown error';
-                throw new CRDInstanceError(`Kro instance deployment failed (state=${state}): ${errorMessage}`, apiVersion, kind, instanceName, 'creation');
-            }
             readinessLogger.debug('Kro instance not ready yet, continuing to wait', {
                 instanceName,
                 state,
@@ -194,8 +355,9 @@ export async function waitForKroInstanceReady(options) {
             });
         }
         catch (error) {
-            // Re-throw CRDInstanceError as-is
-            if (error instanceof CRDInstanceError) {
+            // Re-throw CRDInstanceError as-is, and likewise a deterministic RGD-lookup failure that the
+            // lookup already decided is fatal — the 404 swallow below is for the INSTANCE read only.
+            if (error instanceof CRDInstanceError || fatalLookupError) {
                 throw error;
             }
             const k8sError = error;
@@ -213,9 +375,23 @@ export async function waitForKroInstanceReady(options) {
             readinessLogger.debug('Instance not found yet, continuing to wait', { instanceName });
         }
         // Wait before checking again
-        await abortableDelay(pollInterval, abortSignal);
+        if (!(await delayWithinBudget(pollInterval, timeout - (Date.now() - startTime), abortSignal))) {
+            break;
+        }
     }
     const elapsed = Date.now() - startTime;
-    throw new DeploymentTimeoutError(`Timeout waiting for Kro instance ${instanceName} to be ready after ${elapsed}ms (timeout: ${timeout}ms).${factoryContext ? ` This usually means the Kro controller is not running or the RGD deployment failed. Check Kro controller logs: kubectl logs -n kro-system deployment/kro` : ''}`, kind, instanceName, timeout, 'instance-readiness');
+    // A lookup that never succeeded is the most actionable thing known about this timeout — without it
+    // the message reports only "not ready in time" and the wedged-request diagnosis is lost. It is
+    // cleared as soon as a later lookup succeeds, so this only ever describes a lookup that was still
+    // failing when the budget ran out.
+    const lookupDiagnosis = lastLookupDetail
+        ? ` The ResourceGraphDefinition status-schema lookup could not be read, so readiness could not be confirmed; its last failure was: ${lastLookupDetail}`
+        : '';
+    const timeoutError = new DeploymentTimeoutError(`Timeout waiting for Kro instance ${instanceName} to be ready after ${elapsed}ms (timeout: ${timeout}ms).${factoryContext ? ` This usually means the Kro controller is not running or the RGD deployment failed. Check Kro controller logs: kubectl logs -n kro-system deployment/kro` : ''}${lookupDiagnosis}`, kind, instanceName, timeout, 'instance-readiness');
+    // The message carries the readable detail; the original rejection stays reachable as the cause so
+    // a caller that inspects `statusCode` / `body` still can.
+    if (lastLookupCause !== undefined)
+        timeoutError.cause = lastLookupCause;
+    throw timeoutError;
 }
 //# sourceMappingURL=kro-readiness.js.map

package/dist/core/deployment/kro-readiness.js.map

@@ -1 +1 @@
-{"version":3,"file":"kro-readiness.js","sourceRoot":"","sources":["../../../src/core/deployment/kro-readiness.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,EACzB,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACrF,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AA4CtF,SAAS,cAAc,CAAC,EAAU,EAAE,WAAyB;IAC3D,WAAW,EAAE,cAAc,EAAE,CAAC;IAC9B,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IAC3E,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,OAAO,GAAG,GAAG,EAAE;YACnB,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,MAAM,CAAC,WAAW,CAAC,MAAM,IAAI,IAAI,YAAY,CAAC,2BAA2B,EAAE,YAAY,CAAC,CAAC,CAAC;QAC5F,CAAC,CAAC;QACF,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;YAC9B,WAAW,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAClD,OAAO,EAAE,CAAC;QACZ,CAAC,EAAE,EAAE,CAAC,CAAC;QACP,WAAW,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,OAA4B;IACxE,MAAM,EACJ,YAAY,EACZ,OAAO,EACP,MAAM,EACN,gBAAgB,EAChB,SAAS,EACT,UAAU,EACV,IAAI,EACJ,OAAO,EACP,YAAY,GAAG,0BAA0B,EACzC,cAAc,EACd,WAAW,GACZ,GAAG,OAAO,CAAC;IAEZ,MAAM,MAAM,GAAG,kBAAkB,CAAC,eAAe,CAAC,CAAC;IACnD,MAAM,eAAe,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;IAChE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,OAAO,EAAE,CAAC;QACxC,WAAW,EAAE,cAAc,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,iGAAiG;YACjG,+FAA+F;YAC/F,8FAA8F;YAC9F,MAAM,WAAW,GAAG,cAAc,CAChC,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,EAClC,yBAAyB,CAC1B,CAAC;YACF,IAAI,WAAW,IAAI,CAAC;gBAAE,MAAM;YAC5B,MAAM,QAAQ,GAAG,MAAM,eAAe,CACpC,GAAG,EAAE,CACH,MAAM,CAAC,IAAI,CAAC;gBACV,UAAU;gBACV,IAAI;gBACJ,QAAQ,EAAE;oBACR,IAAI,EAAE,YAAY;oBAClB,SAAS;iBACV;aACF,CAAC,EACJ,WAAW,EACX,QAAQ,IAAI,IAAI,YAAY,EAAE,EAC9B,WAAW,CACZ,CAAC;YAEF,qEAAqE;YACrE,MAAM,QAAQ,GAAG,QAehB,CAAC;YAEF,+BAA+B;YAC/B,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;YAC/B,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,eAAe,CAAC,KAAK,CAAC,yCAAyC,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;gBACnF,MAAM,cAAc,CAAC,qBAAqB,EAAE,WAAW,CAAC,CAAC;gBACzD,SAAS;YACX,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;YAC3B,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;YAC3C,yEAAyE;YACzE,MAAM,eAAe,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,gBAAgB,CAAC,CAAC;YAC5E,MAAM,cAAc,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;YAClE,MAAM,UAAU,GAAG,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;YACjD,MAAM,kBAAkB,GAAG,CAAC,SAAkD,EAAE,EAAE,CAChF,SAAS,EAAE,MAAM,KAAK,MAAM;gBAC5B,CAAC,UAAU,KAAK,SAAS;oBACvB,SAAS,CAAC,kBAAkB,KAAK,SAAS;oBAC1C,SAAS,CAAC,kBAAkB,IAAI,UAAU,CAAC,CAAC;YAEhD,6EAA6E;YAC7E,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACvC,MAAM,cAAc,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;YAC/C,MAAM,qBAAqB,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YAEtF,MAAM,QAAQ,GAAG,KAAK,KAAK,QAAQ,CAAC;YACpC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,eAAe,CAAC,IAAI,kBAAkB,CAAC,cAAc,CAAC,CAAC;YAE3F,kFAAkF;YAClF,IAAI,0BAA0B,GAAG,KAAK,CAAC;YACvC,IAAI,kBAAkB,GAAa,EAAE,CAAC;YACtC,IAAI,CAAC;gBACH,MAAM,cAAc,GAAG,cAAc,CACnC,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,EAClC,yBAAyB,CAC1B,CAAC;gBACF,iGAAiG;gBACjG,8EAA8E;gBAC9E,IAAI,cAAc,IAAI,CAAC;oBAAE,MAAM;gBAC/B,MAAM,WAAW,GAAG,MAAM,eAAe,CACvC,GAAG,EAAE,CACH,gBAAgB,CAAC,sBAAsB,CAAC;oBACtC,KAAK,EAAE,SAAS;oBAChB,OAAO,EAAE,UAAU;oBACnB,MAAM,EAAE,0BAA0B;oBAClC,IAAI,EAAE,OAAO;iBACd,CAAC,EACJ,cAAc,EACd,gCAAgC,OAAO,EAAE,EACzC,WAAW,CACZ,CAAC;gBACF,MAAM,GAAG,GAAG,WAA0B,CAAC;gBACvC,MAAM,eAAe,GAAG,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,IAAI,EAAE,CAAC;gBACvD,kBAAkB,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,MAAM,CACtD,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,CACvC,CAAC;gBACF,0BAA0B,GAAG,kBAAkB,CAAC,MAAM,GAAG,CAAC,CAAC;gBAE3D,eAAe,CAAC,KAAK,CAAC,6CAA6C,EAAE;oBACnE,OAAO;oBACP,aAAa,EAAE,kBAAkB;oBACjC,0BAA0B;iBAC3B,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAc,EAAE,CAAC;gBACxB,8FAA8F;gBAC9F,8FAA8F;gBAC9F,8FAA8F;gBAC9F,kCAAkC;gBAClC,IAAI,KAAK,YAAY,gBAAgB,EAAE,CAAC;oBACtC,MAAM,KAAK,CAAC;gBACd,CAAC;gBACD,eAAe,CAAC,IAAI,CAAC,iEAAiE,EAAE;oBACtF,OAAO;oBACP,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,OAAO;iBAClC,CAAC,CAAC;gBACH,gGAAgG;gBAChG,0BAA0B,GAAG,KAAK,CAAC;YACrC,CAAC;YAED,eAAe,CAAC,KAAK,CAAC,2BAA2B,EAAE;gBACjD,YAAY;gBACZ,KAAK;gBACL,QAAQ;gBACR,QAAQ;gBACR,qBAAqB;gBACrB,0BAA0B;gBAC1B,kBAAkB;gBAClB,UAAU;gBACV,UAAU;gBACV,wBAAwB,EAAE,eAAe,EAAE,kBAAkB;gBAC7D,uBAAuB,EAAE,cAAc,EAAE,kBAAkB;aAC5D,CAAC,CAAC;YAEH,2EAA2E;YAC3E,4EAA4E;YAC5E,wDAAwD;YACxD,MAAM,gBAAgB,GAAG,MAAM,CAAC,KAAK,CAAC;YACtC,MAAM,aAAa,GAAG,OAAO,gBAAgB,KAAK,SAAS,CAAC;YAC5D,MAAM,uBAAuB,GAC3B,kBAAkB,CAAC,MAAM,KAAK,CAAC;gBAC/B,kBAAkB,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;YAChE,oEAAoE;YACpE,0EAA0E;YAC1E,sEAAsE;YACtE,qEAAqE;YACrE,2DAA2D;YAC3D,MAAM,2BAA2B,GAAG,MAAM,CAAC,kBAAkB,CAAC;YAC9D,MAAM,wBAAwB,GAC5B,2BAA2B,KAAK,SAAS;gBACzC,UAAU,KAAK,SAAS;gBACxB,2BAA2B,IAAI,UAAU,CAAC;YAC5C,MAAM,OAAO,GACX,QAAQ;gBACR,QAAQ;gBACR,uBAAuB;gBACvB,wBAAwB;gBACxB,CAAC,CAAC,aAAa,IAAI,gBAAgB,KAAK,IAAI,CAAC,CAAC;YAEhD,IAAI,OAAO,EAAE,CAAC;gBACZ,+FAA+F;gBAC/F,+FAA+F;gBAC/F,yCAAyC;gBACzC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,IAAI,OAAO,EAAE,CAAC;oBACtC,MAAM;gBACR,CAAC;gBACD,eAAe,CAAC,IAAI,CAAC,uBAAuB,EAAE;oBAC5C,YAAY;oBACZ,qBAAqB;oBACrB,0BAA0B;oBAC1B,kBAAkB;iBACnB,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,2EAA2E;YAC3E,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;gBAC5C,MAAM,eAAe,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC;gBACrE,MAAM,YAAY,GAAG,eAAe,EAAE,OAAO,IAAI,eAAe,CAAC;gBACjE,MAAM,IAAI,gBAAgB,CACxB,yCAAyC,KAAK,MAAM,YAAY,EAAE,EAClE,UAAU,EACV,IAAI,EACJ,YAAY,EACZ,UAAU,CACX,CAAC;YACJ,CAAC;YAED,eAAe,CAAC,KAAK,CAAC,gDAAgD,EAAE;gBACtE,YAAY;gBACZ,KAAK;gBACL,QAAQ;gBACR,qBAAqB;gBACrB,kBAAkB;gBAClB,2BAA2B;gBAC3B,wBAAwB;aACzB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,kCAAkC;YAClC,IAAI,KAAK,YAAY,gBAAgB,EAAE,CAAC;gBACtC,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,QAAQ,GAAG,KAKhB,CAAC;YACF,MAAM,SAAS,GACb,QAAQ,CAAC,UAAU;gBACnB,QAAQ,CAAC,IAAI,EAAE,IAAI;gBACnB,CAAC,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAClE,MAAM,UAAU,GACd,SAAS,KAAK,GAAG;gBACjB,QAAQ,CAAC,IAAI,EAAE,MAAM,KAAK,UAAU;gBACpC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,YAAY,CAAC,KAAK,IAAI;gBACjD,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC;YAClD,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,KAAK,CAAC;YACd,CAAC;YACD,2CAA2C;YAC3C,eAAe,CAAC,KAAK,CAAC,4CAA4C,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;QACxF,CAAC;QAED,6BAA6B;QAC7B,MAAM,cAAc,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IACvC,MAAM,IAAI,sBAAsB,CAC9B,oCAAoC,YAAY,sBAAsB,OAAO,gBAAgB,OAAO,OAAO,cAAc,CAAC,CAAC,CAAC,0JAA0J,CAAC,CAAC,CAAC,EAAE,EAAE,EAC7R,IAAI,EACJ,YAAY,EACZ,OAAO,EACP,oBAAoB,CACrB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"kro-readiness.js","sourceRoot":"","sources":["../../../src/core/deployment/kro-readiness.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,EACzB,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AA4CpE,SAAS,cAAc,CAAC,EAAU,EAAE,WAAyB;IAC3D,WAAW,EAAE,cAAc,EAAE,CAAC;IAC9B,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IAC3E,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,OAAO,GAAG,GAAG,EAAE;YACnB,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,MAAM,CAAC,WAAW,CAAC,MAAM,IAAI,IAAI,YAAY,CAAC,2BAA2B,EAAE,YAAY,CAAC,CAAC,CAAC;QAC5F,CAAC,CAAC;QACF,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;YAC9B,WAAW,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAClD,OAAO,EAAE,CAAC;QACZ,CAAC,EAAE,EAAE,CAAC,CAAC;QACP,WAAW,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,iBAAiB,CAC9B,EAAU,EACV,SAAiB,EACjB,WAAyB;IAEzB,IAAI,SAAS,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACjC,MAAM,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,WAAW,CAAC,CAAC;IAC3D,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,OAA4B;IACxE,MAAM,EACJ,YAAY,EACZ,OAAO,EACP,MAAM,EACN,gBAAgB,EAChB,SAAS,EACT,UAAU,EACV,IAAI,EACJ,OAAO,EACP,YAAY,GAAG,0BAA0B,EACzC,cAAc,EACd,WAAW,GACZ,GAAG,OAAO,CAAC;IAEZ,MAAM,MAAM,GAAG,kBAAkB,CAAC,eAAe,CAAC,CAAC;IACnD,MAAM,eAAe,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;IAChE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B;;;;;;;;;;OAUG;IACH,IAAI,gBAAoC,CAAC;IACzC,qGAAqG;IACrG,IAAI,eAAwB,CAAC;IAC7B,+FAA+F;IAC/F,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/C,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,OAAO,EAAE,CAAC;QACxC,WAAW,EAAE,cAAc,EAAE,CAAC;QAC9B;;;;;;WAMG;QACH,IAAI,gBAAgB,GAAG,KAAK,CAAC;QAC7B,IAAI,CAAC;YACH,iGAAiG;YACjG,+FAA+F;YAC/F,8FAA8F;YAC9F,MAAM,WAAW,GAAG,cAAc,CAChC,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,EAClC,yBAAyB,CAC1B,CAAC;YACF,IAAI,WAAW,IAAI,CAAC;gBAAE,MAAM;YAC5B,MAAM,QAAQ,GAAG,MAAM,eAAe,CACpC,GAAG,EAAE,CACH,MAAM,CAAC,IAAI,CAAC;gBACV,UAAU;gBACV,IAAI;gBACJ,QAAQ,EAAE;oBACR,IAAI,EAAE,YAAY;oBAClB,SAAS;iBACV;aACF,CAAC,EACJ,WAAW,EACX,QAAQ,IAAI,IAAI,YAAY,EAAE,EAC9B,WAAW,CACZ,CAAC;YAEF,qEAAqE;YACrE,MAAM,QAAQ,GAAG,QAehB,CAAC;YAEF,+BAA+B;YAC/B,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;YAC/B,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,eAAe,CAAC,KAAK,CAAC,yCAAyC,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;gBACnF,IACE,CAAC,CAAC,MAAM,iBAAiB,CACvB,qBAAqB,EACrB,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,EAClC,WAAW,CACZ,CAAC,EACF,CAAC;oBACD,MAAM;gBACR,CAAC;gBACD,SAAS;YACX,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;YAC3B,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;YAC3C,MAAM,UAAU,GAAG,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;YAEjD,wFAAwF;YACxF,EAAE;YACF,+FAA+F;YAC/F,4FAA4F;YAC5F,2FAA2F;YAC3F,0FAA0F;YAC1F,2FAA2F;YAC3F,0FAA0F;YAC1F,sFAAsF;YACtF,EAAE;YACF,8FAA8F;YAC9F,4FAA4F;YAC5F,8FAA8F;YAC9F,sFAAsF;YACtF,6FAA6F;YAC7F,6FAA6F;YAC7F,0FAA0F;YAC1F,0EAA0E;YAC1E,EAAE;YACF,qFAAqF;YACrF,2FAA2F;YAC3F,sEAAsE;YACtE,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;gBAC5C,MAAM,eAAe,GAAG,UAAU,CAAC,IAAI,CACrC,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,MAAM,KAAK,OAAO;oBACpB,CAAC,UAAU,KAAK,SAAS;wBACvB,CAAC,CAAC,kBAAkB,KAAK,SAAS;wBAClC,CAAC,CAAC,kBAAkB,IAAI,UAAU,CAAC,CACxC,CAAC;gBACF,MAAM,4BAA4B,GAAG,UAAU,CAAC,IAAI,CAClD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,kBAAkB,KAAK,SAAS,CAC1C,CAAC;gBACF,MAAM,sBAAsB,GAC1B,eAAe,KAAK,SAAS;oBAC7B,UAAU,KAAK,SAAS;oBACxB,CAAC,4BAA4B,CAAC;gBAChC,IAAI,sBAAsB,EAAE,CAAC;oBAC3B,MAAM,YAAY,GAAG,eAAe,EAAE,OAAO,IAAI,eAAe,CAAC;oBACjE,MAAM,IAAI,gBAAgB,CACxB,yCAAyC,KAAK,MAAM,YAAY,EAAE,EAClE,UAAU,EACV,IAAI,EACJ,YAAY,EACZ,UAAU,CACX,CAAC;gBACJ,CAAC;gBACD,eAAe,CAAC,KAAK,CACnB,+FAA+F,EAC/F;oBACE,YAAY;oBACZ,KAAK;oBACL,UAAU;oBACV,4BAA4B,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,kBAAkB,CAAC;iBAC1E,CACF,CAAC;YACJ,CAAC;YAED,yEAAyE;YACzE,MAAM,eAAe,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,gBAAgB,CAAC,CAAC;YAC5E,MAAM,cAAc,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;YAClE,MAAM,kBAAkB,GAAG,CAAC,SAAkD,EAAE,EAAE,CAChF,SAAS,EAAE,MAAM,KAAK,MAAM;gBAC5B,CAAC,UAAU,KAAK,SAAS;oBACvB,SAAS,CAAC,kBAAkB,KAAK,SAAS;oBAC1C,SAAS,CAAC,kBAAkB,IAAI,UAAU,CAAC,CAAC;YAEhD,6EAA6E;YAC7E,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACvC,MAAM,cAAc,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;YAC/C,MAAM,qBAAqB,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YAEtF,MAAM,QAAQ,GAAG,KAAK,KAAK,QAAQ,CAAC;YACpC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,eAAe,CAAC,IAAI,kBAAkB,CAAC,cAAc,CAAC,CAAC;YAE3F,kFAAkF;YAClF,IAAI,0BAA0B,GAAG,KAAK,CAAC;YACvC,IAAI,kBAAkB,GAAa,EAAE,CAAC;YACtC,IAAI,CAAC;gBACH,MAAM,cAAc,GAAG,cAAc,CACnC,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,EAClC,yBAAyB,CAC1B,CAAC;gBACF,iGAAiG;gBACjG,8EAA8E;gBAC9E,IAAI,cAAc,IAAI,CAAC;oBAAE,MAAM;gBAC/B,MAAM,WAAW,GAAG,MAAM,eAAe,CACvC,GAAG,EAAE,CACH,gBAAgB,CAAC,sBAAsB,CAAC;oBACtC,KAAK,EAAE,SAAS;oBAChB,OAAO,EAAE,UAAU;oBACnB,MAAM,EAAE,0BAA0B;oBAClC,IAAI,EAAE,OAAO;iBACd,CAAC,EACJ,cAAc,EACd,gCAAgC,OAAO,EAAE,EACzC,WAAW,CACZ,CAAC;gBACF,MAAM,GAAG,GAAG,WAA0B,CAAC;gBACvC,MAAM,eAAe,GAAG,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,IAAI,EAAE,CAAC;gBACvD,kBAAkB,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,MAAM,CACtD,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,CACvC,CAAC;gBACF,0BAA0B,GAAG,kBAAkB,CAAC,MAAM,GAAG,CAAC,CAAC;gBAC3D,wFAAwF;gBACxF,yFAAyF;gBACzF,oDAAoD;gBACpD,gBAAgB,GAAG,SAAS,CAAC;gBAC7B,eAAe,GAAG,SAAS,CAAC;gBAE5B,eAAe,CAAC,KAAK,CAAC,6CAA6C,EAAE;oBACnE,OAAO;oBACP,aAAa,EAAE,kBAAkB;oBACjC,0BAA0B;iBAC3B,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAc,EAAE,CAAC;gBACxB,4FAA4F;gBAC5F,4FAA4F;gBAC5F,6FAA6F;gBAC7F,sFAAsF;gBACtF,yFAAyF;gBACzF,EAAE;gBACF,4FAA4F;gBAC5F,2FAA2F;gBAC3F,uFAAuF;gBACvF,2EAA2E;gBAC3E,sFAAsF;gBACtF,qFAAqF;gBACrF,mFAAmF;gBACnF,kFAAkF;gBAClF,4EAA4E;gBAC5E,EAAE;gBACF,uFAAuF;gBACvF,6FAA6F;gBAC7F,oFAAoF;gBACpF,yFAAyF;gBACzF,6FAA6F;gBAC7F,MAAM,UAAU,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;gBAC5C,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC;oBAC1B,oFAAoF;oBACpF,wFAAwF;oBACxF,8EAA8E;oBAC9E,gBAAgB,GAAG,IAAI,CAAC;oBACxB,MAAM,KAAK,CAAC;gBACd,CAAC;gBAED,4FAA4F;gBAC5F,4FAA4F;gBAC5F,0FAA0F;gBAC1F,wFAAwF;gBACxF,4FAA4F;gBAC5F,yBAAyB;gBACzB,gBAAgB,GAAG,UAAU,CAAC,MAAM,CAAC;gBACrC,4FAA4F;gBAC5F,gGAAgG;gBAChG,eAAe,GAAG,KAAK,CAAC;gBACxB,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC;oBAChD,oBAAoB,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;oBAC3C,eAAe,CAAC,IAAI,CAClB,gHAAgH,EAChH;wBACE,OAAO;wBACP,cAAc,EAAE,UAAU,CAAC,cAAc;wBACzC,MAAM,EAAE,UAAU,CAAC,OAAO;wBAC1B,KAAK,EAAE,gBAAgB;qBACxB,CACF,CAAC;gBACJ,CAAC;gBACD,0FAA0F;gBAC1F,4DAA4D;gBAC5D,IACE,CAAC,CAAC,MAAM,iBAAiB,CAAC,YAAY,EAAE,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,EAAE,WAAW,CAAC,CAAC,EACzF,CAAC;oBACD,MAAM;gBACR,CAAC;gBACD,SAAS;YACX,CAAC;YAED,eAAe,CAAC,KAAK,CAAC,2BAA2B,EAAE;gBACjD,YAAY;gBACZ,KAAK;gBACL,QAAQ;gBACR,QAAQ;gBACR,qBAAqB;gBACrB,0BAA0B;gBAC1B,kBAAkB;gBAClB,UAAU;gBACV,UAAU;gBACV,wBAAwB,EAAE,eAAe,EAAE,kBAAkB;gBAC7D,uBAAuB,EAAE,cAAc,EAAE,kBAAkB;aAC5D,CAAC,CAAC;YAEH,2EAA2E;YAC3E,4EAA4E;YAC5E,wDAAwD;YACxD,MAAM,gBAAgB,GAAG,MAAM,CAAC,KAAK,CAAC;YACtC,MAAM,aAAa,GAAG,OAAO,gBAAgB,KAAK,SAAS,CAAC;YAC5D,MAAM,uBAAuB,GAC3B,kBAAkB,CAAC,MAAM,KAAK,CAAC;gBAC/B,kBAAkB,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;YAChE,oEAAoE;YACpE,0EAA0E;YAC1E,sEAAsE;YACtE,qEAAqE;YACrE,2DAA2D;YAC3D,MAAM,2BAA2B,GAAG,MAAM,CAAC,kBAAkB,CAAC;YAC9D,MAAM,wBAAwB,GAC5B,2BAA2B,KAAK,SAAS;gBACzC,UAAU,KAAK,SAAS;gBACxB,2BAA2B,IAAI,UAAU,CAAC;YAC5C,MAAM,OAAO,GACX,QAAQ;gBACR,QAAQ;gBACR,uBAAuB;gBACvB,wBAAwB;gBACxB,CAAC,CAAC,aAAa,IAAI,gBAAgB,KAAK,IAAI,CAAC,CAAC;YAEhD,IAAI,OAAO,EAAE,CAAC;gBACZ,+FAA+F;gBAC/F,+FAA+F;gBAC/F,yCAAyC;gBACzC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,IAAI,OAAO,EAAE,CAAC;oBACtC,MAAM;gBACR,CAAC;gBACD,eAAe,CAAC,IAAI,CAAC,uBAAuB,EAAE;oBAC5C,YAAY;oBACZ,qBAAqB;oBACrB,0BAA0B;oBAC1B,kBAAkB;iBACnB,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,eAAe,CAAC,KAAK,CAAC,gDAAgD,EAAE;gBACtE,YAAY;gBACZ,KAAK;gBACL,QAAQ;gBACR,qBAAqB;gBACrB,kBAAkB;gBAClB,2BAA2B;gBAC3B,wBAAwB;aACzB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,4FAA4F;YAC5F,yFAAyF;YACzF,IAAI,KAAK,YAAY,gBAAgB,IAAI,gBAAgB,EAAE,CAAC;gBAC1D,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,QAAQ,GAAG,KAKhB,CAAC;YACF,MAAM,SAAS,GACb,QAAQ,CAAC,UAAU;gBACnB,QAAQ,CAAC,IAAI,EAAE,IAAI;gBACnB,CAAC,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAClE,MAAM,UAAU,GACd,SAAS,KAAK,GAAG;gBACjB,QAAQ,CAAC,IAAI,EAAE,MAAM,KAAK,UAAU;gBACpC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,YAAY,CAAC,KAAK,IAAI;gBACjD,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC;YAClD,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,KAAK,CAAC;YACd,CAAC;YACD,2CAA2C;YAC3C,eAAe,CAAC,KAAK,CAAC,4CAA4C,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;QACxF,CAAC;QAED,6BAA6B;QAC7B,IAAI,CAAC,CAAC,MAAM,iBAAiB,CAAC,YAAY,EAAE,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC;YAC9F,MAAM;QACR,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IACvC,mGAAmG;IACnG,+FAA+F;IAC/F,kGAAkG;IAClG,mCAAmC;IACnC,MAAM,eAAe,GAAG,gBAAgB;QACtC,CAAC,CAAC,mIAAmI,gBAAgB,EAAE;QACvJ,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,YAAY,GAAG,IAAI,sBAAsB,CAC7C,oCAAoC,YAAY,sBAAsB,OAAO,gBAAgB,OAAO,OAAO,cAAc,CAAC,CAAC,CAAC,0JAA0J,CAAC,CAAC,CAAC,EAAE,GAAG,eAAe,EAAE,EAC/S,IAAI,EACJ,YAAY,EACZ,OAAO,EACP,oBAAoB,CACrB,CAAC;IACF,kGAAkG;IAClG,0DAA0D;IAC1D,IAAI,eAAe,KAAK,SAAS;QAAE,YAAY,CAAC,KAAK,GAAG,eAAe,CAAC;IACxE,MAAM,YAAY,CAAC;AACrB,CAAC"}

package/dist/core/deployment/poll-timeout.d.ts

@@ -19,9 +19,26 @@
  * exec-auth failure mode is to avoid per-request exec auth during polling (e.g. a pre-minted bearer token
  * in the kubeconfig), so no credential subprocess is spawned in the first place.
  */
-/** Thrown when a readiness-poll API call exceeds its per-call budget (distinguishable so callers can fail fast vs. retry). */
-export declare class PollTimeoutError extends Error {
+/**
+ * A Kubernetes request that did not return within its budget — whichever layer noticed first.
+ *
+ * TWO layers can time the same request out, and callers must not have to care which won. The Bun
+ * HTTP library arms its socket timer synchronously while the request is being issued; a wrapper
+ * added by {@link withCallDeadline} arms its timer afterwards. With equal budgets the socket timer
+ * therefore fires FIRST, so a gate that recognised only the wrapper's error would treat a genuine
+ * timeout as an ordinary failure — and a gate that fails OPEN on ordinary failures would silently
+ * skip its assertion. Both layers raise this type; {@link isRequestTimeoutError} recognises it.
+ */
+export declare class RequestTimeoutError extends Error {
     readonly timeoutMs: number;
+    /** Structural marker, so recognition survives duplicate module instances where `instanceof` does not. */
+    readonly isRequestTimeout: true;
+    constructor(message: string, timeoutMs: number);
+}
+/** True for a timeout raised by EITHER timing layer — the socket's or a {@link withCallDeadline} wrapper's. */
+export declare function isRequestTimeoutError(error: unknown): error is RequestTimeoutError;
+/** Thrown when a readiness-poll API call exceeds its per-call budget (distinguishable so callers can fail fast vs. retry). */
+export declare class PollTimeoutError extends RequestTimeoutError {
     constructor(label: string, timeoutMs: number);
 }
 /**
@@ -42,4 +59,65 @@ export declare function callWithTimeout<T>(op: () => Promise<T>, timeoutMs: numb
  * {@link callWithTimeout}.
  */
 export declare function perCallTimeout(remainingMs: number, capMs: number): number;
+/**
+ * The per-verb request budget {@link withCallDeadline} applies. Reads are expected to be quick;
+ * creates and updates may sit behind admission webhooks; deletes may wait on finalizers — the same
+ * split the repo's HTTP defaults already make, so a caller's configured `httpTimeouts` is honored
+ * per verb instead of being flattened onto the read budget. `create` and `update` are kept APART
+ * because `HttpTimeoutConfig` exposes them separately: collapsing them into one write budget makes
+ * one of the two configured values unreachable.
+ */
+export interface CallDeadlineBudget {
+    /** GET / LIST and anything not classified as a create, an update or a delete. */
+    readonly read: number;
+    /** POST — `create*`. */
+    readonly create: number;
+    /** PUT / PATCH — `replace*`, `patch*`, server-side apply. */
+    readonly update: number;
+    /** DELETE. */
+    readonly delete: number;
+}
+/**
+ * Derive a per-verb budget from a caller's {@link HttpTimeoutConfig}-shaped options, each verb
+ * capped by `capMs` (normally the deployment timeout) so one request can never outlive the
+ * operation it belongs to. Non-positive / non-finite values fall back to the repo defaults —
+ * notably `timeout: 0`, which is NOT nullish and would otherwise collapse every budget to zero.
+ */
+export declare function callDeadlineBudget(timeouts: {
+    readonly default?: number | undefined;
+    readonly create?: number | undefined;
+    readonly update?: number | undefined;
+    readonly delete?: number | undefined;
+} | undefined, capMs?: number): CallDeadlineBudget;
+/**
+ * Classify a client method by name so it is bounded by its own verb's budget, matching the split the
+ * HTTP layer already makes by method (POST → create, PUT/PATCH → update, DELETE → delete). Anything
+ * else — `read`, `list`, `get*`, `listClusterCustomObject`, and any method a future client version
+ * adds — is treated as a READ, the shortest budget. Erring toward the short budget is deliberate: a
+ * misclassified call fails fast and visibly rather than hanging. A combined name (`createOrReplace`)
+ * resolves to `create`, the verb such a helper attempts first.
+ */
+export declare function callDeadlineVerb(method: string): keyof CallDeadlineBudget;
+/**
+ * Wrap a Kubernetes API client so every request it issues is bounded by its verb's budget.
+ *
+ * Readiness polls already bound their own calls (see {@link callWithTimeout}); everything a handler
+ * does AROUND a deploy — drift checks, safety gates, CRD migrations, teardown — historically did
+ * not, so a single wedged request (a hung exec credential, a half-open socket, an API server that
+ * accepts the connection and never answers) hangs the whole reconcile with no log line and no
+ * error. Bounding at the client makes each of those calls reject with a {@link PollTimeoutError}
+ * naming the client and the method.
+ *
+ * EVERY function-valued property is wrapped, not an allow-list of known method names: a client
+ * method this module has never heard of must not silently escape the bound. A wrapped call whose
+ * return value is not thenable is handed back untouched, so synchronous helpers keep working.
+ *
+ * Same SCOPE / LIMITATION as {@link callWithTimeout}: this bounds the caller's `await`, it does not
+ * cancel the in-flight request or kill a wedged exec-auth subprocess.
+ */
+export declare function withCallDeadline<T extends object>(api: T, options: {
+    readonly budget: CallDeadlineBudget;
+    readonly label: string;
+    readonly abortSignal?: AbortSignal;
+}): T;
 //# sourceMappingURL=poll-timeout.d.ts.map

package/dist/core/deployment/poll-timeout.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"poll-timeout.d.ts","sourceRoot":"","sources":["../../../src/core/deployment/poll-timeout.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,8HAA8H;AAC9H,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;gBACf,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM;CAS7C;AAED;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CAAC,CAAC,EACrC,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EACpB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,WAAW,CAAC,EAAE,WAAW,GACxB,OAAO,CAAC,CAAC,CAAC,CAuBZ;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEzE"}
+{"version":3,"file":"poll-timeout.d.ts","sourceRoot":"","sources":["../../../src/core/deployment/poll-timeout.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAQH;;;;;;;;;GASG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,yGAAyG;IACzG,QAAQ,CAAC,gBAAgB,EAAG,IAAI,CAAU;gBAC9B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM;CAK/C;AAED,+GAA+G;AAC/G,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,mBAAmB,CAOlF;AAED,8HAA8H;AAC9H,qBAAa,gBAAiB,SAAQ,mBAAmB;gBAC3C,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM;CAS7C;AAED;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CAAC,CAAC,EACrC,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EACpB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,WAAW,CAAC,EAAE,WAAW,GACxB,OAAO,CAAC,CAAC,CAAC,CAuBZ;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEzE;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IACjC,iFAAiF;IACjF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,wBAAwB;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,6DAA6D;IAC7D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,cAAc;IACd,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAOD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EACJ;IACE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACtC,GACD,SAAS,EACb,KAAK,CAAC,EAAE,MAAM,GACb,kBAAkB,CAYpB;AASD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,kBAAkB,CAKzE;AAsDD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,SAAS,MAAM,EAC/C,GAAG,EAAE,CAAC,EACN,OAAO,EAAE;IACP,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACpC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;CACpC,GACA,CAAC,CA0BH"}