typekro 0.34.0 → 0.36.0

package/dist/core/deployment/k8s-helpers.d.ts

@@ -31,12 +31,78 @@ export declare function isConflictError(error: unknown): boolean;
  * `unserved` / `unknown` split on.
  */
 export type ApiReadFailure = 'notFound' | 'forbidden' | 'timeout' | 'unreachable' | 'other';
+/**
+ * Certificate verification failures: one end refused the other's certificate.
+ *
+ * This is the COMPLETE set of certificate-verification codes Node documents under "OpenSSL error
+ * codes" in https://nodejs.org/api/errors.html — every subsection of it (Time Validity, Trust or
+ * Chain Related, Basic Extension, Name Related, Usage and Policy, Formatting) — rather than the
+ * handful a reader happens to have seen. Completeness is the point: a code missing from this set
+ * falls through to {@link isRetryableError}, whose last rule retries ANY `TypeError` mentioning
+ * `fetch`, and Node's `fetch()` spells every one of these as exactly that. One omission therefore
+ * does not degrade gracefully — it polls a revoked certificate until the deadline and reports a
+ * timeout instead of the cause, which is the bug this classification exists to prevent.
+ *
+ * The one code in that doc section deliberately LEFT OUT is `OUT_OF_MEM`, which lives there because
+ * OpenSSL can raise it during verification but describes a resource shortage, not a verdict on the
+ * certificate — the only member of the section that can read differently on a later attempt.
+ *
+ * `ERR_TLS_CERT_ALTNAME_INVALID` is Node's own (it checks the hostname against the certificate's
+ * subjectAltNames itself, outside OpenSSL's verifier) and is the same kind of deterministic fact.
+ *
+ * Also included, and NOT from that doc page: the fatal TLS certificate alerts a PEER sends when it
+ * rejects OUR certificate — the mTLS direction a kubeconfig client cert takes. OpenSSL surfaces an
+ * incoming alert as its reason string, which Node exposes as `ERR_SSL_` + the uppercased reason, so
+ * a server that rejects a stale kubeconfig certificate arrives as `ERR_SSL_TLSV1_ALERT_UNKNOWN_CA`
+ * rather than any `CERT_*` code. The alert names are those of RFC 5246 §7.2.2 / RFC 8446 §6.2, and
+ * each listed one is a verdict on a certificate that will be reached identically next time.
+ *
+ * @internal Exported only so the unit tests can assert the membership itself — the prefix fallback
+ * in {@link isTlsConfigurationCode} would otherwise let a code silently drop out of this list
+ * without a single test noticing. Not re-exported from the package index.
+ */
+export declare const TLS_CERTIFICATE_CODES: ReadonlySet<string>;
+/**
+ * Handshake failures that are not about a certificate: the two ends cannot agree on a protocol.
+ *
+ * Every member is a persistent mismatch between two configurations, so each is listed with the
+ * reason it qualifies rather than swept in by an `ERR_SSL_*` prefix — most `ERR_SSL_*` codes are
+ * pass-throughs of arbitrary OpenSSL reasons, and some (an allocation failure, a decrypt error on a
+ * corrupted record) genuinely can differ on the next attempt.
+ *
+ * - `EPROTO` — libuv's errno for a handshake OpenSSL aborted. The two ends could not complete a
+ *   handshake at all; nothing about asking again changes what they support.
+ * - `ERR_SSL_WRONG_VERSION_NUMBER` — the bytes on the wire are not a TLS record. Classically an
+ *   `https://` URL pointing at a plain-HTTP listener: an address/scheme fact, fixed in config.
+ * - `ERR_SSL_UNKNOWN_PROTOCOL` — the same situation as reported by OpenSSL's older reason string.
+ * - `ERR_SSL_UNSUPPORTED_PROTOCOL` — the peer's protocol version is not enabled on this side.
+ * - `ERR_SSL_VERSION_TOO_LOW` / `ERR_SSL_VERSION_TOO_HIGH` — the version the peer offers falls
+ *   outside this side's configured `minVersion`/`maxVersion` window.
+ * - `ERR_SSL_NO_PROTOCOLS_AVAILABLE` — this side's own TLS context has every version disabled, a
+ *   purely local configuration error that cannot resolve itself.
+ * - `ERR_SSL_TLSV1_ALERT_PROTOCOL_VERSION` — the peer's fatal alert (RFC 5246 §7.2.2) stating that
+ *   the version we offered is unacceptable to it.
+ *
+ * Note what is NOT here: generic handshake alerts such as `ERR_SSL_SSLV3_ALERT_HANDSHAKE_FAILURE`,
+ * which OpenSSL emits for several unrelated conditions and which therefore cannot be called a
+ * persistent mismatch on the strength of the code alone.
+ *
+ * @internal Exported for the same reason as {@link TLS_CERTIFICATE_CODES}.
+ */
+export declare const TLS_PROTOCOL_CONFIGURATION_CODES: ReadonlySet<string>;
 /**
  * Classify why a read against the API server failed.
  *
  * Deliberately conservative: anything not positively recognised is `other`,
  * which callers treat the same as `unreachable` — "we did not learn the answer"
  * — rather than as a negative answer.
+ *
+ * Ordered on the same invariant as {@link classifyReadError}: an HTTP status means the server
+ * ANSWERED, so it outranks every transport heuristic below it. That matters more here than
+ * anywhere, because this taxonomy's whole subject is whether the server was reached: calling a
+ * 422 that happens to carry a stale `ECONNRESET` code `unreachable` would state, in a log line
+ * about the cluster, the opposite of what the status proves. A status the list below does not
+ * name is `other` — the server answered, just not in a way this taxonomy has a word for.
  */
 export declare function classifyApiReadError(error: unknown): ApiReadFailure;
 /** Short human phrase for an {@link ApiReadFailure}, for a log line or a reason string. */
@@ -65,6 +131,8 @@ export type ReadErrorClassification =
  | 'permission-denied'
 /** 400/405/422 and other client errors — the request itself is malformed or rejected. */
  | 'invalid-request'
+/** The TLS handshake failed on trust, identity or protocol — a client/cluster misconfiguration. */
+ | 'tls-configuration-error'
 /** A programming error with no Kubernetes API shape at all. */
  | 'not-a-kubernetes-error';
 /** A classified read failure, with the pieces an error message needs. */
@@ -83,7 +151,15 @@ export interface ReadErrorAssessment {
  *
  * Built on the shared predicates in `../kubernetes/errors.js` — {@link getErrorStatusCode} for the
  * status across every client-version error shape, and {@link isRetryableError} for the transient
- * set — so this adds a retry policy rather than a second error taxonomy.
+ * set — so this adds a retry policy rather than a second error taxonomy. It additionally recognises
+ * the transport shapes those predicates miss: {@link isRequestTimeoutError} and Node's socket/DNS
+ * `code`s make "the request never got an answer" `transient` however it was spelled, while a TLS
+ * trust/protocol `code` — including one buried in a `fetch failed` `cause` — is separated out as
+ * the permanent misconfiguration it is.
+ *
+ * Shared with the engine's external-reference resolver, whose policy is that a permanent failure
+ * fails immediately, so a classification is only `retryable` when asking again could plausibly
+ * succeed with nothing else changing.
  */
 export declare function classifyReadError(error: unknown): ReadErrorAssessment;
 /**

package/dist/core/deployment/k8s-helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"k8s-helpers.d.ts","sourceRoot":"","sources":["../../../src/core/deployment/k8s-helpers.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,KAAK,GAAG,MAAM,yBAAyB,CAAC;AAYpD;;GAEG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAmBvD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAYvD;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,WAAW,GAAG,SAAS,GAAG,aAAa,GAAG,OAAO,CAAC;AAwC5F;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,cAAc,CAkCnE;AAED,2FAA2F;AAC3F,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,CAatE;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAG3D;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,uBAAuB;AACjC,yEAAyE;AACvE,kBAAkB;AACpB,kEAAkE;GAChE,WAAW;AACb,yFAAyF;GACvF,uBAAuB;AACzB,yEAAyE;GACvE,mBAAmB;AACrB,yFAAyF;GACvF,iBAAiB;AACnB,+DAA+D;GAC7D,wBAAwB,CAAC;AAE7B,yEAAyE;AACzE,MAAM,WAAW,mBAAmB;IAClC,cAAc,EAAE,uBAAuB,CAAC;IACxC,oFAAoF;IACpF,SAAS,EAAE,OAAO,CAAC;IACnB,4FAA4F;IAC5F,OAAO,EAAE,MAAM,CAAC;IAChB,+FAA+F;IAC/F,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC;AAuED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,mBAAmB,CAYrE;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAMxD;AAED;;GAEG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAUnE;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,CAoBlE;AAED;;;GAGG;AACH,wBAAsB,mCAAmC,CACvD,MAAM,EAAE,GAAG,CAAC,mBAAmB,EAC/B,QAAQ,EAAE,GAAG,CAAC,gBAAgB,EAC9B,SAAS,GAAE,OAAO,GAAG,WAAqB,GACzC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAwB/B;AAED;;;GAGG;AACH,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE;IACR,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE;QACP,UAAU,CAAC,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAC;YAAC,OAAO,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KACzF,CAAC;IACF,QAAQ,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9D,EACD,IAAI,EAAE,MAAM,GACX,OAAO,QAAQ,CA+BjB"}
+{"version":3,"file":"k8s-helpers.d.ts","sourceRoot":"","sources":["../../../src/core/deployment/k8s-helpers.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,KAAK,GAAG,MAAM,yBAAyB,CAAC;AAcpD;;GAEG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAmBvD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAYvD;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,WAAW,GAAG,SAAS,GAAG,aAAa,GAAG,OAAO,CAAC;AA8D5F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,qBAAqB,EAAE,WAAW,CAAC,MAAM,CA6CpD,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,gCAAgC,EAAE,WAAW,CAAC,MAAM,CAS/D,CAAC;AAgDH;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,cAAc,CAqCnE;AAED,2FAA2F;AAC3F,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,CAatE;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAG3D;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,uBAAuB;AACjC,yEAAyE;AACvE,kBAAkB;AACpB,kEAAkE;GAChE,WAAW;AACb,yFAAyF;GACvF,uBAAuB;AACzB,yEAAyE;GACvE,mBAAmB;AACrB,yFAAyF;GACvF,iBAAiB;AACnB,mGAAmG;GACjG,yBAAyB;AAC3B,+DAA+D;GAC7D,wBAAwB,CAAC;AAE7B,yEAAyE;AACzE,MAAM,WAAW,mBAAmB;IAClC,cAAc,EAAE,uBAAuB,CAAC;IACxC,oFAAoF;IACpF,SAAS,EAAE,OAAO,CAAC;IACnB,4FAA4F;IAC5F,OAAO,EAAE,MAAM,CAAC;IAChB,+FAA+F;IAC/F,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC;AA+HD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,mBAAmB,CAiBrE;AA6BD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAMxD;AAED;;GAEG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAUnE;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,CAoBlE;AAED;;;GAGG;AACH,wBAAsB,mCAAmC,CACvD,MAAM,EAAE,GAAG,CAAC,mBAAmB,EAC/B,QAAQ,EAAE,GAAG,CAAC,gBAAgB,EAC9B,SAAS,GAAE,OAAO,GAAG,WAAqB,GACzC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAwB/B;AAED;;;GAGG;AACH,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE;IACR,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE;QACP,UAAU,CAAC,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAC;YAAC,OAAO,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KACzF,CAAC;IACF,QAAQ,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9D,EACD,IAAI,EAAE,MAAM,GACX,OAAO,QAAQ,CA+BjB"}

package/dist/core/deployment/k8s-helpers.js

@@ -4,8 +4,9 @@
  * Extracted from engine.ts. Contains error classification, media type handling,
  * and resource patching utilities.
  */
-import { formatKubernetesError, getErrorDetails, getErrorStatusCode, isRetryableError, } from '../kubernetes/errors.js';
+import { formatKubernetesError, getErrorDetails, getErrorStatusCode, isRetryableError, RETRYABLE_STATUS_CODES, } from '../kubernetes/errors.js';
 import { getComponentLogger } from '../logging/index.js';
+import { isRequestTimeoutError } from './poll-timeout.js';
 const logger = getComponentLogger('k8s-helpers');
 /**
  * Check if an error is a "not found" error (HTTP 404)
@@ -84,21 +85,208 @@ const UNREACHABLE_CODES = new Set([
     'UNABLE_TO_VERIFY_LEAF_SIGNATURE',
     'ERR_TLS_CERT_ALTNAME_INVALID',
 ]);
+/**
+ * Transport `code`s that describe a connection which may come up on a later attempt: a refused or
+ * reset socket, an unreachable route, a DNS blip, a connect timeout.
+ *
+ * Deliberately NOT {@link UNREACHABLE_CODES}. That set answers a different question — "did the
+ * server ever answer?" — and so it also lists the TLS trust codes, which answer "did the transport
+ * come up?" with a permanent no. Retrying those for a multi-minute readiness budget only hides a
+ * misconfiguration behind a timeout, so the retry policy keeps its own, narrower set.
+ */
+const RETRYABLE_SYSTEM_CODES = new Set([
+    'ECONNREFUSED',
+    'ECONNRESET',
+    'EHOSTUNREACH',
+    'ENETUNREACH',
+    'ENOTFOUND',
+    'EAI_AGAIN',
+    'EPIPE',
+    'ETIMEDOUT',
+    'ESOCKETTIMEDOUT',
+    'UND_ERR_CONNECT_TIMEOUT',
+]);
+/**
+ * Certificate verification failures: one end refused the other's certificate.
+ *
+ * This is the COMPLETE set of certificate-verification codes Node documents under "OpenSSL error
+ * codes" in https://nodejs.org/api/errors.html — every subsection of it (Time Validity, Trust or
+ * Chain Related, Basic Extension, Name Related, Usage and Policy, Formatting) — rather than the
+ * handful a reader happens to have seen. Completeness is the point: a code missing from this set
+ * falls through to {@link isRetryableError}, whose last rule retries ANY `TypeError` mentioning
+ * `fetch`, and Node's `fetch()` spells every one of these as exactly that. One omission therefore
+ * does not degrade gracefully — it polls a revoked certificate until the deadline and reports a
+ * timeout instead of the cause, which is the bug this classification exists to prevent.
+ *
+ * The one code in that doc section deliberately LEFT OUT is `OUT_OF_MEM`, which lives there because
+ * OpenSSL can raise it during verification but describes a resource shortage, not a verdict on the
+ * certificate — the only member of the section that can read differently on a later attempt.
+ *
+ * `ERR_TLS_CERT_ALTNAME_INVALID` is Node's own (it checks the hostname against the certificate's
+ * subjectAltNames itself, outside OpenSSL's verifier) and is the same kind of deterministic fact.
+ *
+ * Also included, and NOT from that doc page: the fatal TLS certificate alerts a PEER sends when it
+ * rejects OUR certificate — the mTLS direction a kubeconfig client cert takes. OpenSSL surfaces an
+ * incoming alert as its reason string, which Node exposes as `ERR_SSL_` + the uppercased reason, so
+ * a server that rejects a stale kubeconfig certificate arrives as `ERR_SSL_TLSV1_ALERT_UNKNOWN_CA`
+ * rather than any `CERT_*` code. The alert names are those of RFC 5246 §7.2.2 / RFC 8446 §6.2, and
+ * each listed one is a verdict on a certificate that will be reached identically next time.
+ *
+ * @internal Exported only so the unit tests can assert the membership itself — the prefix fallback
+ * in {@link isTlsConfigurationCode} would otherwise let a code silently drop out of this list
+ * without a single test noticing. Not re-exported from the package index.
+ */
+export const TLS_CERTIFICATE_CODES = new Set([
+    // --- Node, "OpenSSL error codes": Time Validity Errors -----------------------
+    'CERT_NOT_YET_VALID',
+    'CERT_HAS_EXPIRED',
+    'CRL_NOT_YET_VALID',
+    'CRL_HAS_EXPIRED',
+    'CERT_REVOKED',
+    // --- Trust or Chain Related Errors -------------------------------------------
+    'UNABLE_TO_GET_ISSUER_CERT',
+    'UNABLE_TO_GET_ISSUER_CERT_LOCALLY',
+    'DEPTH_ZERO_SELF_SIGNED_CERT',
+    'SELF_SIGNED_CERT_IN_CHAIN',
+    'CERT_CHAIN_TOO_LONG',
+    'UNABLE_TO_GET_CRL',
+    'UNABLE_TO_VERIFY_LEAF_SIGNATURE',
+    'CERT_UNTRUSTED',
+    // --- Basic Extension Errors ---------------------------------------------------
+    'INVALID_CA',
+    'PATH_LENGTH_EXCEEDED',
+    // --- Name Related Errors ------------------------------------------------------
+    'HOSTNAME_MISMATCH',
+    // --- Usage and Policy Errors --------------------------------------------------
+    'INVALID_PURPOSE',
+    'CERT_REJECTED',
+    // --- Formatting Errors --------------------------------------------------------
+    'CERT_SIGNATURE_FAILURE',
+    'CRL_SIGNATURE_FAILURE',
+    'ERROR_IN_CERT_NOT_BEFORE_FIELD',
+    'ERROR_IN_CERT_NOT_AFTER_FIELD',
+    'ERROR_IN_CRL_LAST_UPDATE_FIELD',
+    'ERROR_IN_CRL_NEXT_UPDATE_FIELD',
+    'UNABLE_TO_DECRYPT_CERT_SIGNATURE',
+    'UNABLE_TO_DECRYPT_CRL_SIGNATURE',
+    'UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY',
+    // (`OUT_OF_MEM` is the one member of that section NOT listed — see the note above.)
+    // --- Node's own hostname check ------------------------------------------------
+    'ERR_TLS_CERT_ALTNAME_INVALID',
+    // --- Fatal certificate alerts received FROM the peer (our client cert refused) --
+    'ERR_SSL_SSLV3_ALERT_BAD_CERTIFICATE',
+    'ERR_SSL_SSLV3_ALERT_UNSUPPORTED_CERTIFICATE',
+    'ERR_SSL_SSLV3_ALERT_CERTIFICATE_REVOKED',
+    'ERR_SSL_SSLV3_ALERT_CERTIFICATE_EXPIRED',
+    'ERR_SSL_SSLV3_ALERT_CERTIFICATE_UNKNOWN',
+    'ERR_SSL_TLSV1_ALERT_UNKNOWN_CA',
+    'ERR_SSL_TLSV13_ALERT_CERTIFICATE_REQUIRED',
+]);
+/**
+ * Handshake failures that are not about a certificate: the two ends cannot agree on a protocol.
+ *
+ * Every member is a persistent mismatch between two configurations, so each is listed with the
+ * reason it qualifies rather than swept in by an `ERR_SSL_*` prefix — most `ERR_SSL_*` codes are
+ * pass-throughs of arbitrary OpenSSL reasons, and some (an allocation failure, a decrypt error on a
+ * corrupted record) genuinely can differ on the next attempt.
+ *
+ * - `EPROTO` — libuv's errno for a handshake OpenSSL aborted. The two ends could not complete a
+ *   handshake at all; nothing about asking again changes what they support.
+ * - `ERR_SSL_WRONG_VERSION_NUMBER` — the bytes on the wire are not a TLS record. Classically an
+ *   `https://` URL pointing at a plain-HTTP listener: an address/scheme fact, fixed in config.
+ * - `ERR_SSL_UNKNOWN_PROTOCOL` — the same situation as reported by OpenSSL's older reason string.
+ * - `ERR_SSL_UNSUPPORTED_PROTOCOL` — the peer's protocol version is not enabled on this side.
+ * - `ERR_SSL_VERSION_TOO_LOW` / `ERR_SSL_VERSION_TOO_HIGH` — the version the peer offers falls
+ *   outside this side's configured `minVersion`/`maxVersion` window.
+ * - `ERR_SSL_NO_PROTOCOLS_AVAILABLE` — this side's own TLS context has every version disabled, a
+ *   purely local configuration error that cannot resolve itself.
+ * - `ERR_SSL_TLSV1_ALERT_PROTOCOL_VERSION` — the peer's fatal alert (RFC 5246 §7.2.2) stating that
+ *   the version we offered is unacceptable to it.
+ *
+ * Note what is NOT here: generic handshake alerts such as `ERR_SSL_SSLV3_ALERT_HANDSHAKE_FAILURE`,
+ * which OpenSSL emits for several unrelated conditions and which therefore cannot be called a
+ * persistent mismatch on the strength of the code alone.
+ *
+ * @internal Exported for the same reason as {@link TLS_CERTIFICATE_CODES}.
+ */
+export const TLS_PROTOCOL_CONFIGURATION_CODES = new Set([
+    'EPROTO',
+    'ERR_SSL_WRONG_VERSION_NUMBER',
+    'ERR_SSL_UNKNOWN_PROTOCOL',
+    'ERR_SSL_UNSUPPORTED_PROTOCOL',
+    'ERR_SSL_VERSION_TOO_LOW',
+    'ERR_SSL_VERSION_TOO_HIGH',
+    'ERR_SSL_NO_PROTOCOLS_AVAILABLE',
+    'ERR_SSL_TLSV1_ALERT_PROTOCOL_VERSION',
+]);
+/**
+ * Whether a transport `code` names a TLS failure that will recur identically on every attempt.
+ *
+ * The union of {@link TLS_CERTIFICATE_CODES} and {@link TLS_PROTOCOL_CONFIGURATION_CODES}, plus one
+ * deliberate catch-all: an UNRECOGNISED code beginning `CERT_` is also treated as a certificate
+ * verdict. Every `CERT_*` code OpenSSL defines is a verification result — a statement about the
+ * certificate presented, not about the network — so a code this list has not caught up with (a
+ * newer OpenSSL, a reason Node has not documented) is far better failed fast and named in the
+ * message than polled for a 25-minute budget and then reported as a timeout. The explicit list is
+ * kept rather than replaced by the prefix, both because most of the codes above do not start with
+ * `CERT_` and so the prefix could never stand alone, and so the tests keep asserting the real
+ * membership instead of a pattern that would pass for any invented string.
+ */
+function isTlsConfigurationCode(code) {
+    return (TLS_CERTIFICATE_CODES.has(code) ||
+        TLS_PROTOCOL_CONFIGURATION_CODES.has(code) ||
+        code.startsWith('CERT_') ||
+        // Node's own `ERR_TLS_*` family (https://nodejs.org/api/errors.html) is configuration, security-state
+        // and programming errors: `ERR_TLS_DH_PARAM_SIZE` (the peer offered too small a Diffie-Hellman
+        // parameter), `ERR_TLS_INVALID_PROTOCOL_VERSION`, `ERR_TLS_PROTOCOL_VERSION_CONFLICT`,
+        // `ERR_TLS_INVALID_CONTEXT`, renegotiation policy, … — none of which a retry a second later can
+        // change. The one member that IS a passing condition, `ERR_TLS_HANDSHAKE_TIMEOUT`, is carved out
+        // by the caller before this predicate runs.
+        (code.startsWith('ERR_TLS_') && code !== TLS_HANDSHAKE_TIMEOUT_CODE));
+}
+/** Node's one transient `ERR_TLS_*` code: the handshake did not finish in time — ask again. */
+const TLS_HANDSHAKE_TIMEOUT_CODE = 'ERR_TLS_HANDSHAKE_TIMEOUT';
+/**
+ * The transport `code`, following one level of `cause`.
+ *
+ * Node's `fetch()` — what the 1.x client uses — reports every transport failure as the same opaque
+ * `TypeError: fetch failed` and hangs the real error off `cause`. Reading only the top-level `code`
+ * therefore sees nothing at all on the shape that matters most, and the failure falls through to
+ * the message sniff in {@link isRetryableError}, which retries any `TypeError` mentioning `fetch`.
+ */
+function transportErrorCode(error) {
+    const own = systemErrorCode(error);
+    if (own)
+        return own;
+    if (!error || typeof error !== 'object')
+        return undefined;
+    return systemErrorCode(error.cause);
+}
 /**
  * Classify why a read against the API server failed.
  *
  * Deliberately conservative: anything not positively recognised is `other`,
  * which callers treat the same as `unreachable` — "we did not learn the answer"
  * — rather than as a negative answer.
+ *
+ * Ordered on the same invariant as {@link classifyReadError}: an HTTP status means the server
+ * ANSWERED, so it outranks every transport heuristic below it. That matters more here than
+ * anywhere, because this taxonomy's whole subject is whether the server was reached: calling a
+ * 422 that happens to carry a stale `ECONNRESET` code `unreachable` would state, in a log line
+ * about the cluster, the opposite of what the status proves. A status the list below does not
+ * name is `other` — the server answered, just not in a way this taxonomy has a word for.
  */
 export function classifyApiReadError(error) {
     if (isNotFoundError(error))
         return 'notFound';
     const status = apiErrorStatus(error);
-    if (status === 401 || status === 403)
-        return 'forbidden';
-    if (status === 408 || status === 504)
-        return 'timeout';
+    if (status !== undefined) {
+        if (status === 401 || status === 403)
+            return 'forbidden';
+        if (status === 408 || status === 504)
+            return 'timeout';
+        return 'other';
+    }
     const code = systemErrorCode(error);
     if (code && TIMEOUT_CODES.has(code))
         return 'timeout';
@@ -154,6 +342,7 @@ const READ_ERROR_SUMMARIES = {
     'unknown-resource-type': 'unknown resource type',
     'permission-denied': 'permission denied',
     'invalid-request': 'invalid request',
+    'tls-configuration-error': 'TLS configuration error',
     'not-a-kubernetes-error': 'not a Kubernetes API error',
 };
 const RETRYABLE_READ_CLASSIFICATIONS = new Set(['object-not-found', 'transient']);
@@ -191,41 +380,133 @@ function isUnknownResourceTypeError(error, statusCode) {
         !details.name &&
         !details.kind);
 }
+/**
+ * The classification, split at the one question that orders everything else: did the API server
+ * ANSWER?
+ *
+ * An HTTP status is proof that it did — the request reached the server, the server formed a
+ * verdict, and it sent one back. That verdict therefore OUTRANKS every piece of evidence that the
+ * transport failed, because a transport that failed could not have carried a status. The two kinds
+ * of evidence do co-occur: a client can attach a system `code` to a status-bearing error (a socket
+ * reset while draining an error body, a `code` copied from an earlier attempt), and Node's
+ * `fetch()` spells its failures as a `TypeError` whose message `isRetryableError` sniffs for the
+ * word `fetch` — which a status-bearing `TypeError` matches just as well. Deciding on the transport
+ * evidence first therefore turned a 422 into `transient` and polled a request the server had
+ * already rejected until the readiness budget expired.
+ *
+ * So: while a status exists, only the status is consulted, and no message or `code` heuristic runs
+ * at all. Only once there is no status does the "the request never produced an HTTP response"
+ * ladder below run — TLS verdict, this repo's own request-timeout types, Node's socket/DNS codes,
+ * then the shared retryable predicate's message sniffs.
+ */
 function classifyReadErrorKind(error, statusCode) {
+    // First regardless: the API resource itself not being served is recognised both from a 404 whose
+    // Status body names no object and, with no status at all, from the client's own discovery miss.
     if (isUnknownResourceTypeError(error, statusCode))
         return 'unknown-resource-type';
-    if (statusCode === 401 || statusCode === 403)
-        return 'permission-denied';
-    if (statusCode === 404)
-        return 'object-not-found';
-    // Covers 408/429/5xx plus connection resets, DNS failures and fetch-level TypeErrors.
+    // ---- The server answered. Its answer decides, and nothing else is consulted. ----
+    if (statusCode !== undefined) {
+        if (statusCode === 401 || statusCode === 403)
+            return 'permission-denied';
+        if (statusCode === 404)
+            return 'object-not-found';
+        if (RETRYABLE_STATUS_CODES.has(statusCode))
+            return 'transient';
+        if (statusCode >= 400 && statusCode < 500)
+            return 'invalid-request';
+        // Any other status the server produced — a 5xx outside the retryable list, or anything the
+        // client turned into an error without a 4xx/5xx code. The server is up and talking, so the
+        // conservative reading is "ask again", not "this is permanently broken".
+        return 'transient';
+    }
+    // ---- No status: the request never produced an HTTP response. ----
+    // The transport `code` is read BEFORE `isRetryableError`, and a permanent TLS failure is
+    // recognised before any retryable shape, because that predicate's last resort is a message sniff:
+    // it retries ANY `TypeError` whose message mentions `fetch`. Node's `fetch()` reports a rejected
+    // server certificate as exactly that — `TypeError: fetch failed` with the real code on `cause` —
+    // so consulting the code first is the whole of what keeps a misconfigured CA bundle out of the
+    // retry loop instead of burning the readiness budget on it.
+    const transportCode = transportErrorCode(error);
+    // A handshake that merely ran out of time is the one TLS-namespaced failure that is transient.
+    if (transportCode === TLS_HANDSHAKE_TIMEOUT_CODE) {
+        return 'transient';
+    }
+    if (transportCode && isTlsConfigurationCode(transportCode)) {
+        return 'tls-configuration-error';
+    }
+    // The two "the request never got an answer" shapes `isRetryableError` does not recognise, both of
+    // which are as transient as the 408 it does recognise — ask again and the server may well answer:
+    //   1. This repo's own timing layers. A bare `RequestTimeoutError` (the Bun HTTP library's socket
+    //      timer) and its subclasses `PollTimeoutError` / `PrematureCloseError` carry no HTTP status,
+    //      so without this they land in `not-a-kubernetes-error` and a retry loop gives up on a blip.
+    //   2. Node's socket/DNS `code`s. `isRetryableError` only sniffs MESSAGES, so `ECONNRESET` whose
+    //      message is the bare `read ECONNRESET` is missed.
+    if (isRequestTimeoutError(error))
+        return 'transient';
+    if (transportCode && RETRYABLE_SYSTEM_CODES.has(transportCode))
+        return 'transient';
+    // Connection resets, DNS failures and fetch-level TypeErrors, recognised by message.
     if (isRetryableError(error))
         return 'transient';
-    if (statusCode === undefined)
-        return 'not-a-kubernetes-error';
-    if (statusCode >= 400 && statusCode < 500)
-        return 'invalid-request';
-    return 'transient';
+    return 'not-a-kubernetes-error';
 }
 /**
  * Classify a failed Kubernetes read as worth retrying or permanently broken.
  *
  * Built on the shared predicates in `../kubernetes/errors.js` — {@link getErrorStatusCode} for the
  * status across every client-version error shape, and {@link isRetryableError} for the transient
- * set — so this adds a retry policy rather than a second error taxonomy.
+ * set — so this adds a retry policy rather than a second error taxonomy. It additionally recognises
+ * the transport shapes those predicates miss: {@link isRequestTimeoutError} and Node's socket/DNS
+ * `code`s make "the request never got an answer" `transient` however it was spelled, while a TLS
+ * trust/protocol `code` — including one buried in a `fetch failed` `cause` — is separated out as
+ * the permanent misconfiguration it is.
+ *
+ * Shared with the engine's external-reference resolver, whose policy is that a permanent failure
+ * fails immediately, so a classification is only `retryable` when asking again could plausibly
+ * succeed with nothing else changing.
  */
 export function classifyReadError(error) {
     const statusCode = getErrorStatusCode(error);
     const classification = classifyReadErrorKind(error, statusCode);
     const label = READ_ERROR_SUMMARIES[classification];
+    const detail = describeReadError(error);
+    // `TypeError: fetch failed` says nothing an operator can act on, so a TLS failure names the code
+    // and what to look at. Everything else already carries its own message.
+    const tlsCode = classification === 'tls-configuration-error' ? transportErrorCode(error) : undefined;
     return {
         classification,
         retryable: RETRYABLE_READ_CLASSIFICATIONS.has(classification),
         summary: statusCode === undefined ? label : `${label} (HTTP ${statusCode})`,
-        detail: describeReadError(error),
+        detail: tlsCode ? `${detail} (${tlsCode}: ${tlsDiagnosticHint(tlsCode)})` : detail,
         statusCode,
     };
 }
+/**
+ * Where to send the operator for a given TLS failure code.
+ *
+ * The three groups {@link isTlsConfigurationCode} accepts fail for different reasons and are fixed
+ * in different places, so each gets its own hint rather than one catch-all:
+ *
+ * - A certificate VERDICT — a member of {@link TLS_CERTIFICATE_CODES}, or an unrecognised `CERT_`
+ *   code — is about the trust material: the CA bundle in the kubeconfig, or the certificate the
+ *   API server presents.
+ * - A PROTOCOL mismatch — a member of {@link TLS_PROTOCOL_CONFIGURATION_CODES} — is about what is
+ *   at the other end of the address and which TLS versions each side allows.
+ * - Anything else here reached the classification through the generic `ERR_TLS_` prefix rule:
+ *   `ERR_TLS_DH_PARAM_SIZE`, `ERR_TLS_INVALID_CONTEXT`, `ERR_TLS_PROTOCOL_VERSION_CONFLICT` and
+ *   the rest of Node's own namespace. These say nothing about a certificate, so pointing at the CA
+ *   bundle would send the operator to the one thing that is not wrong; the honest hint is the TLS
+ *   configuration on either side, which is what those codes actually describe.
+ */
+function tlsDiagnosticHint(code) {
+    if (TLS_CERTIFICATE_CODES.has(code) || code.startsWith('CERT_')) {
+        return 'check the cluster CA / server certificate';
+    }
+    if (TLS_PROTOCOL_CONFIGURATION_CODES.has(code)) {
+        return 'check the server URL scheme / port and the TLS version settings';
+    }
+    return 'check the client/server TLS configuration';
+}
 /**
  * Best available human-readable description of a read failure.
  *

package/dist/core/deployment/k8s-helpers.js.map

@@ -1 +1 @@
-{"version":3,"file":"k8s-helpers.js","sourceRoot":"","sources":["../../../src/core/deployment/k8s-helpers.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EACL,qBAAqB,EACrB,eAAe,EACf,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAGzD,MAAM,MAAM,GAAG,kBAAkB,CAAC,aAAa,CAAC,CAAC;AAEjD;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,yEAAyE;QACzE,yEAAyE;QACzE,2EAA2E;QAC3E,2EAA2E;QAC3E,2EAA2E;QAC3E,0EAA0E;QAC1E,MAAM,QAAQ,GAAG,KAA+C,CAAC;QACjE,OAAO,CACL,QAAQ,CAAC,UAAU,KAAK,GAAG;YAC3B,QAAQ,CAAC,QAAQ,EAAE,UAAU,KAAK,GAAG;YACrC,QAAQ,CAAC,IAAI,EAAE,IAAI,KAAK,GAAG;YAC3B,QAAQ,CAAC,IAAI,KAAK,GAAG;YACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,KAAK,UAAU;YACpC,CAAC,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ,IAAI,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CACtF,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,QAAQ,GAAG,KAA+C,CAAC;QACjE,OAAO,CACL,QAAQ,CAAC,UAAU,KAAK,GAAG;YAC3B,QAAQ,CAAC,QAAQ,EAAE,UAAU,KAAK,GAAG;YACrC,QAAQ,CAAC,IAAI,EAAE,IAAI,KAAK,GAAG;YAC3B,QAAQ,CAAC,IAAI,KAAK,GAAG;YACrB,CAAC,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ,IAAI,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CACtF,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAaD,6EAA6E;AAC7E,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC1D,MAAM,QAAQ,GAAG,KAAwD,CAAC;IAC1E,MAAM,WAAW,GAAG,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IAClF,OAAO,CACL,QAAQ,CAAC,UAAU,IAAI,QAAQ,CAAC,QAAQ,EAAE,UAAU,IAAI,QAAQ,CAAC,IAAI,EAAE,IAAI,IAAI,WAAW,CAC3F,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC1D,MAAM,IAAI,GAAI,KAA4B,CAAC,IAAI,CAAC;IAChD,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACrD,CAAC;AAED,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,CAAC,CAAC;AAE3F,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,cAAc;IACd,YAAY;IACZ,cAAc;IACd,aAAa;IACb,WAAW;IACX,WAAW;IACX,OAAO;IACP,QAAQ;IACR,uEAAuE;IACvE,sEAAsE;IACtE,kBAAkB;IAClB,oBAAoB;IACpB,6BAA6B;IAC7B,2BAA2B;IAC3B,iCAAiC;IACjC,8BAA8B;CAC/B,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,IAAI,eAAe,CAAC,KAAK,CAAC;QAAE,OAAO,UAAU,CAAC;IAE9C,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,WAAW,CAAC;IACzD,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,SAAS,CAAC;IAEvD,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,IAAI,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACtD,IAAI,IAAI,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,aAAa,CAAC;IAE9D,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IAC7E,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IACtC,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,SAAS,CAAC;IAC5E,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,SAAS,CAAC;IACnF,IACE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;QAC7B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;QAChC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAClC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAClC,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,IACE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;QAC/B,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QACpC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;QAChC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;QAC/B,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAClC,CAAC;QACD,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,sBAAsB,CAAC,OAAuB;IAC5D,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,UAAU;YACb,OAAO,yBAAyB,CAAC;QACnC,KAAK,WAAW;YACd,OAAO,gCAAgC,CAAC;QAC1C,KAAK,SAAS;YACZ,OAAO,uBAAuB,CAAC;QACjC,KAAK,aAAa;YAChB,OAAO,gCAAgC,CAAC;QAC1C;YACE,OAAO,oBAAoB,CAAC;IAChC,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,eAAe,CAAC,CAAC;IAC1F,OAAO,GAAG,sBAAsB,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;AAC9E,CAAC;AAoCD,MAAM,oBAAoB,GAA4C;IACpE,kBAAkB,EAAE,WAAW;IAC/B,SAAS,EAAE,qBAAqB;IAChC,uBAAuB,EAAE,uBAAuB;IAChD,mBAAmB,EAAE,mBAAmB;IACxC,iBAAiB,EAAE,iBAAiB;IACpC,wBAAwB,EAAE,4BAA4B;CACvD,CAAC;AAEF,MAAM,8BAA8B,GAClC,IAAI,GAAG,CAA0B,CAAC,kBAAkB,EAAE,WAAW,CAAC,CAAC,CAAC;AAEtE;;;;;;;;;GASG;AACH,SAAS,0BAA0B,CAAC,KAAc,EAAE,UAA8B;IAChF,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,QAAQ,GAAG,KAA2B,CAAC;IAE7C,IACE,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ;QACpC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,mCAAmC,CAAC,EAC9D,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,UAAU,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IAErC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC3B,IACE,OAAO,IAAI,EAAE,OAAO,KAAK,QAAQ;QACjC,wCAAwC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAC3D,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,8FAA8F;IAC9F,mFAAmF;IACnF,MAAM,OAAO,GAAG,IAAI,EAAE,OAAO,CAAC;IAC9B,OAAO,CACL,IAAI,EAAE,MAAM,KAAK,UAAU;QAC3B,CAAC,CAAC,OAAO;QACT,OAAO,OAAO,KAAK,QAAQ;QAC3B,CAAC,OAAO,CAAC,IAAI;QACb,CAAC,OAAO,CAAC,IAAI,CACd,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAC5B,KAAc,EACd,UAA8B;IAE9B,IAAI,0BAA0B,CAAC,KAAK,EAAE,UAAU,CAAC;QAAE,OAAO,uBAAuB,CAAC;IAClF,IAAI,UAAU,KAAK,GAAG,IAAI,UAAU,KAAK,GAAG;QAAE,OAAO,mBAAmB,CAAC;IACzE,IAAI,UAAU,KAAK,GAAG;QAAE,OAAO,kBAAkB,CAAC;IAClD,sFAAsF;IACtF,IAAI,gBAAgB,CAAC,KAAK,CAAC;QAAE,OAAO,WAAW,CAAC;IAChD,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,wBAAwB,CAAC;IAC9D,IAAI,UAAU,IAAI,GAAG,IAAI,UAAU,GAAG,GAAG;QAAE,OAAO,iBAAiB,CAAC;IACpE,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,MAAM,UAAU,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,cAAc,GAAG,qBAAqB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,oBAAoB,CAAC,cAAc,CAAC,CAAC;IAEnD,OAAO;QACL,cAAc;QACd,SAAS,EAAE,8BAA8B,CAAC,GAAG,CAAC,cAAc,CAAC;QAC7D,OAAO,EAAE,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,UAAU,UAAU,GAAG;QAC3E,MAAM,EAAE,iBAAiB,CAAC,KAAK,CAAC;QAChC,UAAU;KACX,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,MAAM,EAAE,OAAO,EAAE,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,KAAK,iBAAiB,EAAE,CAAC;QACvF,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,qBAAqB,CAAC,KAAK,CAAC,CAAC;AACtC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,2BAA2B,CAAC,KAAc;IACxD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,QAAQ,GAAG,KAA2B,CAAC;IAC7C,OAAO,CACL,QAAQ,CAAC,UAAU,KAAK,GAAG;QAC3B,QAAQ,CAAC,QAAQ,EAAE,UAAU,KAAK,GAAG;QACrC,QAAQ,CAAC,IAAI,EAAE,IAAI,KAAK,GAAG,CAC5B,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAc;IACtD,MAAM,YAAY,GAAG;QACnB,6BAA6B;QAC7B,8BAA8B;QAC9B,8BAA8B;KAC/B,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,KAA2B,CAAC;QAC7C,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,OAAO,IAAI,EAAE,CAAC;QACjE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAErE,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACf,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,CAAC,KAAK,CAAC,0DAA0D,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACpF,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,MAA+B,EAC/B,QAA8B,EAC9B,YAAmC,OAAO;IAE1C,2DAA2D;IAC3D,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,CAAC,KAAK,CAAC,0BAA0B,EAAE;YACvC,IAAI,EAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI;YAC7B,SAAS,EAAE,QAAQ,CAAC,QAAQ,EAAE,SAAS;YACvC,OAAO,EAAE,MAAM,IAAI,QAAQ;YAC3B,aAAa,EAAE,YAAY,IAAI,QAAQ;YACvC,YAAY,EAAG,QAA8C,CAAC,IAAI;gBAChE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAE,QAA6C,CAAC,IAAI,CAAC,CAAC,MAAM;gBACzE,CAAC,CAAC,CAAC;SACN,CAAC,CAAC;IACL,CAAC;IAED,OAAO,MAAM,MAAM,CAAC,KAAK,CACvB,QAAQ,EACR,SAAS,EAAE,SAAS;IACpB,SAAS,EAAE,SAAS;IACpB,SAAS,EAAE,eAAe;IAC1B,SAAS,EAAE,QAAQ;IACnB,SAAS,KAAK,WAAW;QACvB,CAAC,CAAC,wCAAwC;QAC1C,CAAC,CAAC,8BAA8B,CACnC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,4BAA4B,CAC1C,QAMC,EACD,IAAY;IAEZ,wDAAwD;IACxD,IAAI,IAAI,KAAK,gBAAgB,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAqC,CAAC;QAC5D,MAAM,eAAe,GAAG,IAAI,EAAE,IAAI,KAAK,KAAK,CAAC;QAC7C,MAAM,gBAAgB,GAAG,QAAQ,CAAC,QAAQ,EAAE,UAAU,IAAI,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;QAE7F,IACE,eAAe;YACf,gBAAgB;YAChB,CAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,EAC7D,CAAC;YACD,OAAO;gBACL,GAAG,QAAQ;gBACX,MAAM,EAAE;oBACN,GAAG,QAAQ,CAAC,MAAM;oBAClB,UAAU,EAAE;wBACV,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,IAAI,EAAE,CAAC;wBACtC;4BACE,IAAI,EAAE,OAAO;4BACb,MAAM,EAAE,MAAM;4BACd,OAAO,EAAE,8BAA8B;4BACvC,MAAM,EAAE,wBAAwB;yBACjC;qBACF;iBACF;aACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}
+{"version":3,"file":"k8s-helpers.js","sourceRoot":"","sources":["../../../src/core/deployment/k8s-helpers.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EACL,qBAAqB,EACrB,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAE1D,MAAM,MAAM,GAAG,kBAAkB,CAAC,aAAa,CAAC,CAAC;AAEjD;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,yEAAyE;QACzE,yEAAyE;QACzE,2EAA2E;QAC3E,2EAA2E;QAC3E,2EAA2E;QAC3E,0EAA0E;QAC1E,MAAM,QAAQ,GAAG,KAA+C,CAAC;QACjE,OAAO,CACL,QAAQ,CAAC,UAAU,KAAK,GAAG;YAC3B,QAAQ,CAAC,QAAQ,EAAE,UAAU,KAAK,GAAG;YACrC,QAAQ,CAAC,IAAI,EAAE,IAAI,KAAK,GAAG;YAC3B,QAAQ,CAAC,IAAI,KAAK,GAAG;YACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,KAAK,UAAU;YACpC,CAAC,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ,IAAI,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CACtF,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,QAAQ,GAAG,KAA+C,CAAC;QACjE,OAAO,CACL,QAAQ,CAAC,UAAU,KAAK,GAAG;YAC3B,QAAQ,CAAC,QAAQ,EAAE,UAAU,KAAK,GAAG;YACrC,QAAQ,CAAC,IAAI,EAAE,IAAI,KAAK,GAAG;YAC3B,QAAQ,CAAC,IAAI,KAAK,GAAG;YACrB,CAAC,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ,IAAI,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CACtF,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAaD,6EAA6E;AAC7E,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC1D,MAAM,QAAQ,GAAG,KAAwD,CAAC;IAC1E,MAAM,WAAW,GAAG,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IAClF,OAAO,CACL,QAAQ,CAAC,UAAU,IAAI,QAAQ,CAAC,QAAQ,EAAE,UAAU,IAAI,QAAQ,CAAC,IAAI,EAAE,IAAI,IAAI,WAAW,CAC3F,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC1D,MAAM,IAAI,GAAI,KAA4B,CAAC,IAAI,CAAC;IAChD,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACrD,CAAC;AAED,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,CAAC,CAAC;AAE3F,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,cAAc;IACd,YAAY;IACZ,cAAc;IACd,aAAa;IACb,WAAW;IACX,WAAW;IACX,OAAO;IACP,QAAQ;IACR,uEAAuE;IACvE,sEAAsE;IACtE,kBAAkB;IAClB,oBAAoB;IACpB,6BAA6B;IAC7B,2BAA2B;IAC3B,iCAAiC;IACjC,8BAA8B;CAC/B,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IACrC,cAAc;IACd,YAAY;IACZ,cAAc;IACd,aAAa;IACb,WAAW;IACX,WAAW;IACX,OAAO;IACP,WAAW;IACX,iBAAiB;IACjB,yBAAyB;CAC1B,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAwB,IAAI,GAAG,CAAC;IAChE,gFAAgF;IAChF,oBAAoB;IACpB,kBAAkB;IAClB,mBAAmB;IACnB,iBAAiB;IACjB,cAAc;IACd,gFAAgF;IAChF,2BAA2B;IAC3B,mCAAmC;IACnC,6BAA6B;IAC7B,2BAA2B;IAC3B,qBAAqB;IACrB,mBAAmB;IACnB,iCAAiC;IACjC,gBAAgB;IAChB,iFAAiF;IACjF,YAAY;IACZ,sBAAsB;IACtB,iFAAiF;IACjF,mBAAmB;IACnB,iFAAiF;IACjF,iBAAiB;IACjB,eAAe;IACf,iFAAiF;IACjF,wBAAwB;IACxB,uBAAuB;IACvB,gCAAgC;IAChC,+BAA+B;IAC/B,gCAAgC;IAChC,gCAAgC;IAChC,kCAAkC;IAClC,iCAAiC;IACjC,oCAAoC;IACpC,oFAAoF;IACpF,iFAAiF;IACjF,8BAA8B;IAC9B,mFAAmF;IACnF,qCAAqC;IACrC,6CAA6C;IAC7C,yCAAyC;IACzC,yCAAyC;IACzC,yCAAyC;IACzC,gCAAgC;IAChC,2CAA2C;CAC5C,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAwB,IAAI,GAAG,CAAC;IAC3E,QAAQ;IACR,8BAA8B;IAC9B,0BAA0B;IAC1B,8BAA8B;IAC9B,yBAAyB;IACzB,0BAA0B;IAC1B,gCAAgC;IAChC,sCAAsC;CACvC,CAAC,CAAC;AAEH;;;;;;;;;;;;GAYG;AACH,SAAS,sBAAsB,CAAC,IAAY;IAC1C,OAAO,CACL,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC;QAC/B,gCAAgC,CAAC,GAAG,CAAC,IAAI,CAAC;QAC1C,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QACxB,sGAAsG;QACtG,+FAA+F;QAC/F,uFAAuF;QACvF,gGAAgG;QAChG,iGAAiG;QACjG,4CAA4C;QAC5C,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,IAAI,KAAK,0BAA0B,CAAC,CACrE,CAAC;AACJ,CAAC;AAED,+FAA+F;AAC/F,MAAM,0BAA0B,GAAG,2BAA2B,CAAC;AAE/D;;;;;;;GAOG;AACH,SAAS,kBAAkB,CAAC,KAAc;IACxC,MAAM,GAAG,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,GAAG;QAAE,OAAO,GAAG,CAAC;IACpB,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC1D,OAAO,eAAe,CAAE,KAA6B,CAAC,KAAK,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,IAAI,eAAe,CAAC,KAAK,CAAC;QAAE,OAAO,UAAU,CAAC;IAE9C,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,WAAW,CAAC;QACzD,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,SAAS,CAAC;QACvD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,IAAI,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACtD,IAAI,IAAI,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,aAAa,CAAC;IAE9D,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IAC7E,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IACtC,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,SAAS,CAAC;IAC5E,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,SAAS,CAAC;IACnF,IACE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;QAC7B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;QAChC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAClC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAClC,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,IACE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;QAC/B,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QACpC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;QAChC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;QAC/B,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAClC,CAAC;QACD,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,sBAAsB,CAAC,OAAuB;IAC5D,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,UAAU;YACb,OAAO,yBAAyB,CAAC;QACnC,KAAK,WAAW;YACd,OAAO,gCAAgC,CAAC;QAC1C,KAAK,SAAS;YACZ,OAAO,uBAAuB,CAAC;QACjC,KAAK,aAAa;YAChB,OAAO,gCAAgC,CAAC;QAC1C;YACE,OAAO,oBAAoB,CAAC;IAChC,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,eAAe,CAAC,CAAC;IAC1F,OAAO,GAAG,sBAAsB,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;AAC9E,CAAC;AAsCD,MAAM,oBAAoB,GAA4C;IACpE,kBAAkB,EAAE,WAAW;IAC/B,SAAS,EAAE,qBAAqB;IAChC,uBAAuB,EAAE,uBAAuB;IAChD,mBAAmB,EAAE,mBAAmB;IACxC,iBAAiB,EAAE,iBAAiB;IACpC,yBAAyB,EAAE,yBAAyB;IACpD,wBAAwB,EAAE,4BAA4B;CACvD,CAAC;AAEF,MAAM,8BAA8B,GAClC,IAAI,GAAG,CAA0B,CAAC,kBAAkB,EAAE,WAAW,CAAC,CAAC,CAAC;AAEtE;;;;;;;;;GASG;AACH,SAAS,0BAA0B,CAAC,KAAc,EAAE,UAA8B;IAChF,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,QAAQ,GAAG,KAA2B,CAAC;IAE7C,IACE,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ;QACpC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,mCAAmC,CAAC,EAC9D,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,UAAU,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IAErC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC3B,IACE,OAAO,IAAI,EAAE,OAAO,KAAK,QAAQ;QACjC,wCAAwC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAC3D,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,8FAA8F;IAC9F,mFAAmF;IACnF,MAAM,OAAO,GAAG,IAAI,EAAE,OAAO,CAAC;IAC9B,OAAO,CACL,IAAI,EAAE,MAAM,KAAK,UAAU;QAC3B,CAAC,CAAC,OAAO;QACT,OAAO,OAAO,KAAK,QAAQ;QAC3B,CAAC,OAAO,CAAC,IAAI;QACb,CAAC,OAAO,CAAC,IAAI,CACd,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAS,qBAAqB,CAC5B,KAAc,EACd,UAA8B;IAE9B,iGAAiG;IACjG,gGAAgG;IAChG,IAAI,0BAA0B,CAAC,KAAK,EAAE,UAAU,CAAC;QAAE,OAAO,uBAAuB,CAAC;IAElF,oFAAoF;IACpF,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,IAAI,UAAU,KAAK,GAAG,IAAI,UAAU,KAAK,GAAG;YAAE,OAAO,mBAAmB,CAAC;QACzE,IAAI,UAAU,KAAK,GAAG;YAAE,OAAO,kBAAkB,CAAC;QAClD,IAAI,sBAAsB,CAAC,GAAG,CAAC,UAAU,CAAC;YAAE,OAAO,WAAW,CAAC;QAC/D,IAAI,UAAU,IAAI,GAAG,IAAI,UAAU,GAAG,GAAG;YAAE,OAAO,iBAAiB,CAAC;QACpE,2FAA2F;QAC3F,2FAA2F;QAC3F,yEAAyE;QACzE,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,oEAAoE;IACpE,yFAAyF;IACzF,kGAAkG;IAClG,iGAAiG;IACjG,iGAAiG;IACjG,+FAA+F;IAC/F,4DAA4D;IAC5D,MAAM,aAAa,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAChD,+FAA+F;IAC/F,IAAI,aAAa,KAAK,0BAA0B,EAAE,CAAC;QACjD,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,IAAI,aAAa,IAAI,sBAAsB,CAAC,aAAa,CAAC,EAAE,CAAC;QAC3D,OAAO,yBAAyB,CAAC;IACnC,CAAC;IACD,kGAAkG;IAClG,kGAAkG;IAClG,kGAAkG;IAClG,kGAAkG;IAClG,kGAAkG;IAClG,iGAAiG;IACjG,wDAAwD;IACxD,IAAI,qBAAqB,CAAC,KAAK,CAAC;QAAE,OAAO,WAAW,CAAC;IACrD,IAAI,aAAa,IAAI,sBAAsB,CAAC,GAAG,CAAC,aAAa,CAAC;QAAE,OAAO,WAAW,CAAC;IAEnF,qFAAqF;IACrF,IAAI,gBAAgB,CAAC,KAAK,CAAC;QAAE,OAAO,WAAW,CAAC;IAChD,OAAO,wBAAwB,CAAC;AAClC,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,MAAM,UAAU,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,cAAc,GAAG,qBAAqB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,oBAAoB,CAAC,cAAc,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACxC,iGAAiG;IACjG,wEAAwE;IACxE,MAAM,OAAO,GACX,cAAc,KAAK,yBAAyB,CAAC,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEvF,OAAO;QACL,cAAc;QACd,SAAS,EAAE,8BAA8B,CAAC,GAAG,CAAC,cAAc,CAAC;QAC7D,OAAO,EAAE,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,UAAU,UAAU,GAAG;QAC3E,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,MAAM,KAAK,OAAO,KAAK,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM;QAClF,UAAU;KACX,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,iBAAiB,CAAC,IAAY;IACrC,IAAI,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAChE,OAAO,2CAA2C,CAAC;IACrD,CAAC;IACD,IAAI,gCAAgC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/C,OAAO,iEAAiE,CAAC;IAC3E,CAAC;IACD,OAAO,2CAA2C,CAAC;AACrD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,MAAM,EAAE,OAAO,EAAE,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,KAAK,iBAAiB,EAAE,CAAC;QACvF,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,qBAAqB,CAAC,KAAK,CAAC,CAAC;AACtC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,2BAA2B,CAAC,KAAc;IACxD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,QAAQ,GAAG,KAA2B,CAAC;IAC7C,OAAO,CACL,QAAQ,CAAC,UAAU,KAAK,GAAG;QAC3B,QAAQ,CAAC,QAAQ,EAAE,UAAU,KAAK,GAAG;QACrC,QAAQ,CAAC,IAAI,EAAE,IAAI,KAAK,GAAG,CAC5B,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAc;IACtD,MAAM,YAAY,GAAG;QACnB,6BAA6B;QAC7B,8BAA8B;QAC9B,8BAA8B;KAC/B,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,KAA2B,CAAC;QAC7C,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,OAAO,IAAI,EAAE,CAAC;QACjE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAErE,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACf,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,CAAC,KAAK,CAAC,0DAA0D,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACpF,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,MAA+B,EAC/B,QAA8B,EAC9B,YAAmC,OAAO;IAE1C,2DAA2D;IAC3D,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,CAAC,KAAK,CAAC,0BAA0B,EAAE;YACvC,IAAI,EAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI;YAC7B,SAAS,EAAE,QAAQ,CAAC,QAAQ,EAAE,SAAS;YACvC,OAAO,EAAE,MAAM,IAAI,QAAQ;YAC3B,aAAa,EAAE,YAAY,IAAI,QAAQ;YACvC,YAAY,EAAG,QAA8C,CAAC,IAAI;gBAChE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAE,QAA6C,CAAC,IAAI,CAAC,CAAC,MAAM;gBACzE,CAAC,CAAC,CAAC;SACN,CAAC,CAAC;IACL,CAAC;IAED,OAAO,MAAM,MAAM,CAAC,KAAK,CACvB,QAAQ,EACR,SAAS,EAAE,SAAS;IACpB,SAAS,EAAE,SAAS;IACpB,SAAS,EAAE,eAAe;IAC1B,SAAS,EAAE,QAAQ;IACnB,SAAS,KAAK,WAAW;QACvB,CAAC,CAAC,wCAAwC;QAC1C,CAAC,CAAC,8BAA8B,CACnC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,4BAA4B,CAC1C,QAMC,EACD,IAAY;IAEZ,wDAAwD;IACxD,IAAI,IAAI,KAAK,gBAAgB,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAqC,CAAC;QAC5D,MAAM,eAAe,GAAG,IAAI,EAAE,IAAI,KAAK,KAAK,CAAC;QAC7C,MAAM,gBAAgB,GAAG,QAAQ,CAAC,QAAQ,EAAE,UAAU,IAAI,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;QAE7F,IACE,eAAe;YACf,gBAAgB;YAChB,CAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,EAC7D,CAAC;YACD,OAAO;gBACL,GAAG,QAAQ;gBACX,MAAM,EAAE;oBACN,GAAG,QAAQ,CAAC,MAAM;oBAClB,UAAU,EAAE;wBACV,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,IAAI,EAAE,CAAC;wBACtC;4BACE,IAAI,EAAE,OAAO;4BACb,MAAM,EAAE,MAAM;4BACd,OAAO,EAAE,8BAA8B;4BACvC,MAAM,EAAE,wBAAwB;yBACjC;qBACF;iBACF;aACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/core/deployment/kro-artifact-binding-migration.d.ts

@@ -1,6 +1,21 @@
 import type { KubeConfig, KubernetesObject } from '@kubernetes/client-node';
 import { createBunCompatibleKubernetesObjectApi } from '../kubernetes/index.js';
+import { type CallDeadlineBudget } from './poll-timeout.js';
 type MigrationApi = Pick<ReturnType<typeof createBunCompatibleKubernetesObjectApi>, 'read' | 'list' | 'replace'>;
+/**
+ * Injectable seams shared by both cluster operations in this module.
+ *
+ * `requestBudget` / `abortSignal` bound every request the operation issues. Without a bound, a
+ * wedged Kubernetes call here never settles: the caller (the Alchemy reconcile handler) then never
+ * returns and never throws, emits no further log line, and the converge only dies on its outer
+ * timeout. See {@link withCallDeadline}.
+ */
+interface MigrationDependencies {
+    readonly api?: MigrationApi;
+    /** Per-verb request budget. Defaults to the repo's HTTP read/write/delete timeouts. */
+    readonly requestBudget?: CallDeadlineBudget;
+    readonly abortSignal?: AbortSignal;
+}
 /**
  * Repairs KRO's retained-CRD adoption edge after an RGD is recreated.
  *
@@ -11,9 +26,7 @@ type MigrationApi = Pick<ReturnType<typeof createBunCompatibleKubernetesObjectAp
  * finalizer indefinitely. TypeKro deliberately retains generated CRDs for safe
  * reuse, so it must close that adoption gap until KRO does so itself.
  */
-export declare function repairRetainedKroGeneratedCrdOwnership(kubeConfig: KubeConfig, desiredResource: KubernetesObject, dependencies?: {
-    readonly api?: MigrationApi;
-}): Promise<void>;
+export declare function repairRetainedKroGeneratedCrdOwnership(kubeConfig: KubeConfig, desiredResource: KubernetesObject, dependencies?: MigrationDependencies): Promise<void>;
 /**
  * Broadens the generated CRD's released v0.32 artifact-binding schema before
  * KRO sees the topology-independent RGD. KRO rejects a direct fixed-object →
@@ -21,8 +34,6 @@ export declare function repairRetainedKroGeneratedCrdOwnership(kubeConfig: KubeC
  * valid under the map. Updating the CRD first is non-destructive: it only
  * broadens validation and preserves the persisted nested key/value shape.
  */
-export declare function migrateLegacyKroArtifactBindingCrd(kubeConfig: KubeConfig, desiredResource: KubernetesObject, dependencies?: {
-    readonly api?: MigrationApi;
-}): Promise<void>;
+export declare function migrateLegacyKroArtifactBindingCrd(kubeConfig: KubeConfig, desiredResource: KubernetesObject, dependencies?: MigrationDependencies): Promise<void>;
 export {};
 //# sourceMappingURL=kro-artifact-binding-migration.d.ts.map

package/dist/core/deployment/kro-artifact-binding-migration.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"kro-artifact-binding-migration.d.ts","sourceRoot":"","sources":["../../../src/core/deployment/kro-artifact-binding-migration.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAE5E,OAAO,EACL,sCAAsC,EAEvC,MAAM,wBAAwB,CAAC;AAQhC,KAAK,YAAY,GAAG,IAAI,CACtB,UAAU,CAAC,OAAO,sCAAsC,CAAC,EACzD,MAAM,GAAG,MAAM,GAAG,SAAS,CAC5B,CAAC;AA+MF;;;;;;;;;GASG;AACH,wBAAsB,sCAAsC,CAC1D,UAAU,EAAE,UAAU,EACtB,eAAe,EAAE,gBAAgB,EACjC,YAAY,GAAE;IAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,YAAY,CAAA;CAAO,GACjD,OAAO,CAAC,IAAI,CAAC,CAmEf;AAED;;;;;;GAMG;AACH,wBAAsB,kCAAkC,CACtD,UAAU,EAAE,UAAU,EACtB,eAAe,EAAE,gBAAgB,EACjC,YAAY,GAAE;IAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,YAAY,CAAA;CAAO,GACjD,OAAO,CAAC,IAAI,CAAC,CA4Gf"}
+{"version":3,"file":"kro-artifact-binding-migration.d.ts","sourceRoot":"","sources":["../../../src/core/deployment/kro-artifact-binding-migration.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAE5E,OAAO,EACL,sCAAsC,EAEvC,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,KAAK,kBAAkB,EAAwC,MAAM,mBAAmB,CAAC;AAOlG,KAAK,YAAY,GAAG,IAAI,CACtB,UAAU,CAAC,OAAO,sCAAsC,CAAC,EACzD,MAAM,GAAG,MAAM,GAAG,SAAS,CAC5B,CAAC;AAEF;;;;;;;GAOG;AACH,UAAU,qBAAqB;IAC7B,QAAQ,CAAC,GAAG,CAAC,EAAE,YAAY,CAAC;IAC5B,uFAAuF;IACvF,QAAQ,CAAC,aAAa,CAAC,EAAE,kBAAkB,CAAC;IAC5C,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;CACpC;AAkOD;;;;;;;;;GASG;AACH,wBAAsB,sCAAsC,CAC1D,UAAU,EAAE,UAAU,EACtB,eAAe,EAAE,gBAAgB,EACjC,YAAY,GAAE,qBAA0B,GACvC,OAAO,CAAC,IAAI,CAAC,CAmEf;AAED;;;;;;GAMG;AACH,wBAAsB,kCAAkC,CACtD,UAAU,EAAE,UAAU,EACtB,eAAe,EAAE,gBAAgB,EACjC,YAAY,GAAE,qBAA0B,GACvC,OAAO,CAAC,IAAI,CAAC,CA4Gf"}

package/dist/core/deployment/kro-artifact-binding-migration.js

@@ -1,11 +1,25 @@
 import { ensureError } from '../errors.js';
 import { createBunCompatibleKubernetesObjectApi, getErrorStatusCode, } from '../kubernetes/index.js';
 import { KRO_ARTIFACT_BINDINGS_SPEC_FIELD } from '../planning/values.js';
+import { callDeadlineBudget, withCallDeadline } from './poll-timeout.js';
 const STABLE_BINDING_SCHEMA = 'map[string]map[string]string';
 const MAX_CRD_PATCH_ATTEMPTS = 5;
 const KRO_OWNED_LABEL = 'kro.run/owned';
 const KRO_RGD_ID_LABEL = 'kro.run/resource-graph-definition-id';
 const KRO_RGD_NAME_LABEL = 'kro.run/resource-graph-definition-name';
+/**
+ * The bounded client for one RGD operation: the caller's injected API or a fresh one, wrapped so
+ * every request rejects — naming the ResourceGraphDefinition — instead of hanging forever. The
+ * injected API is wrapped too: a test that supplies a wedged client must see the bound, not a hang.
+ */
+function migrationApi(kubeConfig, rgdName, reason, dependencies) {
+    const api = dependencies.api ?? createBunCompatibleKubernetesObjectApi(kubeConfig);
+    return withCallDeadline(api, {
+        budget: dependencies.requestBudget ?? callDeadlineBudget(undefined),
+        label: `ResourceGraphDefinition ${rgdName} (${reason})`,
+        ...(dependencies.abortSignal ? { abortSignal: dependencies.abortSignal } : {}),
+    });
+}
 async function findGeneratedCrd(api, group, kind) {
     const listed = (await api.list('apiextensions.k8s.io/v1', 'CustomResourceDefinition'));
     return listed.items?.find((candidate) => candidate.spec?.group === group && candidate.spec?.names?.kind === kind);
@@ -148,7 +162,7 @@ export async function repairRetainedKroGeneratedCrdOwnership(kubeConfig, desired
     const kind = desiredRgd.spec?.schema?.kind;
     if (!rgdName || !apiVersion || !kind)
         return;
-    const api = dependencies.api ?? createBunCompatibleKubernetesObjectApi(kubeConfig);
+    const api = migrationApi(kubeConfig, rgdName, 'retained-crd-adoption', dependencies);
     const liveRgd = (await api.read({
         apiVersion: 'kro.run/v1alpha1',
         kind: 'ResourceGraphDefinition',
@@ -216,7 +230,7 @@ export async function migrateLegacyKroArtifactBindingCrd(kubeConfig, desiredReso
     const kind = desiredRgd.spec.schema.kind;
     if (!rgdName || !apiVersion || !kind)
         return;
-    const api = dependencies.api ?? createBunCompatibleKubernetesObjectApi(kubeConfig);
+    const api = migrationApi(kubeConfig, rgdName, 'artifact-binding-migration', dependencies);
     let liveRgd;
     try {
         liveRgd = (await api.read({