typekro 0.35.0 → 0.36.0

package/dist/core/deployment/poll-timeout.d.ts

@@ -19,9 +19,26 @@
  * exec-auth failure mode is to avoid per-request exec auth during polling (e.g. a pre-minted bearer token
  * in the kubeconfig), so no credential subprocess is spawned in the first place.
  */
-/** Thrown when a readiness-poll API call exceeds its per-call budget (distinguishable so callers can fail fast vs. retry). */
-export declare class PollTimeoutError extends Error {
+/**
+ * A Kubernetes request that did not return within its budget — whichever layer noticed first.
+ *
+ * TWO layers can time the same request out, and callers must not have to care which won. The Bun
+ * HTTP library arms its socket timer synchronously while the request is being issued; a wrapper
+ * added by {@link withCallDeadline} arms its timer afterwards. With equal budgets the socket timer
+ * therefore fires FIRST, so a gate that recognised only the wrapper's error would treat a genuine
+ * timeout as an ordinary failure — and a gate that fails OPEN on ordinary failures would silently
+ * skip its assertion. Both layers raise this type; {@link isRequestTimeoutError} recognises it.
+ */
+export declare class RequestTimeoutError extends Error {
     readonly timeoutMs: number;
+    /** Structural marker, so recognition survives duplicate module instances where `instanceof` does not. */
+    readonly isRequestTimeout: true;
+    constructor(message: string, timeoutMs: number);
+}
+/** True for a timeout raised by EITHER timing layer — the socket's or a {@link withCallDeadline} wrapper's. */
+export declare function isRequestTimeoutError(error: unknown): error is RequestTimeoutError;
+/** Thrown when a readiness-poll API call exceeds its per-call budget (distinguishable so callers can fail fast vs. retry). */
+export declare class PollTimeoutError extends RequestTimeoutError {
     constructor(label: string, timeoutMs: number);
 }
 /**
@@ -42,4 +59,65 @@ export declare function callWithTimeout<T>(op: () => Promise<T>, timeoutMs: numb
  * {@link callWithTimeout}.
  */
 export declare function perCallTimeout(remainingMs: number, capMs: number): number;
+/**
+ * The per-verb request budget {@link withCallDeadline} applies. Reads are expected to be quick;
+ * creates and updates may sit behind admission webhooks; deletes may wait on finalizers — the same
+ * split the repo's HTTP defaults already make, so a caller's configured `httpTimeouts` is honored
+ * per verb instead of being flattened onto the read budget. `create` and `update` are kept APART
+ * because `HttpTimeoutConfig` exposes them separately: collapsing them into one write budget makes
+ * one of the two configured values unreachable.
+ */
+export interface CallDeadlineBudget {
+    /** GET / LIST and anything not classified as a create, an update or a delete. */
+    readonly read: number;
+    /** POST — `create*`. */
+    readonly create: number;
+    /** PUT / PATCH — `replace*`, `patch*`, server-side apply. */
+    readonly update: number;
+    /** DELETE. */
+    readonly delete: number;
+}
+/**
+ * Derive a per-verb budget from a caller's {@link HttpTimeoutConfig}-shaped options, each verb
+ * capped by `capMs` (normally the deployment timeout) so one request can never outlive the
+ * operation it belongs to. Non-positive / non-finite values fall back to the repo defaults —
+ * notably `timeout: 0`, which is NOT nullish and would otherwise collapse every budget to zero.
+ */
+export declare function callDeadlineBudget(timeouts: {
+    readonly default?: number | undefined;
+    readonly create?: number | undefined;
+    readonly update?: number | undefined;
+    readonly delete?: number | undefined;
+} | undefined, capMs?: number): CallDeadlineBudget;
+/**
+ * Classify a client method by name so it is bounded by its own verb's budget, matching the split the
+ * HTTP layer already makes by method (POST → create, PUT/PATCH → update, DELETE → delete). Anything
+ * else — `read`, `list`, `get*`, `listClusterCustomObject`, and any method a future client version
+ * adds — is treated as a READ, the shortest budget. Erring toward the short budget is deliberate: a
+ * misclassified call fails fast and visibly rather than hanging. A combined name (`createOrReplace`)
+ * resolves to `create`, the verb such a helper attempts first.
+ */
+export declare function callDeadlineVerb(method: string): keyof CallDeadlineBudget;
+/**
+ * Wrap a Kubernetes API client so every request it issues is bounded by its verb's budget.
+ *
+ * Readiness polls already bound their own calls (see {@link callWithTimeout}); everything a handler
+ * does AROUND a deploy — drift checks, safety gates, CRD migrations, teardown — historically did
+ * not, so a single wedged request (a hung exec credential, a half-open socket, an API server that
+ * accepts the connection and never answers) hangs the whole reconcile with no log line and no
+ * error. Bounding at the client makes each of those calls reject with a {@link PollTimeoutError}
+ * naming the client and the method.
+ *
+ * EVERY function-valued property is wrapped, not an allow-list of known method names: a client
+ * method this module has never heard of must not silently escape the bound. A wrapped call whose
+ * return value is not thenable is handed back untouched, so synchronous helpers keep working.
+ *
+ * Same SCOPE / LIMITATION as {@link callWithTimeout}: this bounds the caller's `await`, it does not
+ * cancel the in-flight request or kill a wedged exec-auth subprocess.
+ */
+export declare function withCallDeadline<T extends object>(api: T, options: {
+    readonly budget: CallDeadlineBudget;
+    readonly label: string;
+    readonly abortSignal?: AbortSignal;
+}): T;
 //# sourceMappingURL=poll-timeout.d.ts.map

package/dist/core/deployment/poll-timeout.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"poll-timeout.d.ts","sourceRoot":"","sources":["../../../src/core/deployment/poll-timeout.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,8HAA8H;AAC9H,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;gBACf,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM;CAS7C;AAED;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CAAC,CAAC,EACrC,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EACpB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,WAAW,CAAC,EAAE,WAAW,GACxB,OAAO,CAAC,CAAC,CAAC,CAuBZ;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEzE"}
+{"version":3,"file":"poll-timeout.d.ts","sourceRoot":"","sources":["../../../src/core/deployment/poll-timeout.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAQH;;;;;;;;;GASG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,yGAAyG;IACzG,QAAQ,CAAC,gBAAgB,EAAG,IAAI,CAAU;gBAC9B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM;CAK/C;AAED,+GAA+G;AAC/G,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,mBAAmB,CAOlF;AAED,8HAA8H;AAC9H,qBAAa,gBAAiB,SAAQ,mBAAmB;gBAC3C,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM;CAS7C;AAED;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CAAC,CAAC,EACrC,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EACpB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,WAAW,CAAC,EAAE,WAAW,GACxB,OAAO,CAAC,CAAC,CAAC,CAuBZ;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEzE;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IACjC,iFAAiF;IACjF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,wBAAwB;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,6DAA6D;IAC7D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,cAAc;IACd,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAOD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EACJ;IACE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACtC,GACD,SAAS,EACb,KAAK,CAAC,EAAE,MAAM,GACb,kBAAkB,CAYpB;AASD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,kBAAkB,CAKzE;AAsDD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,SAAS,MAAM,EAC/C,GAAG,EAAE,CAAC,EACN,OAAO,EAAE;IACP,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACpC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;CACpC,GACA,CAAC,CA0BH"}

package/dist/core/deployment/poll-timeout.js

@@ -19,15 +19,42 @@
  * exec-auth failure mode is to avoid per-request exec auth during polling (e.g. a pre-minted bearer token
  * in the kubeconfig), so no credential subprocess is spawned in the first place.
  */
-/** Thrown when a readiness-poll API call exceeds its per-call budget (distinguishable so callers can fail fast vs. retry). */
-export class PollTimeoutError extends Error {
+import { DEFAULT_HTTP_DELETE_TIMEOUT, DEFAULT_HTTP_READ_TIMEOUT, DEFAULT_HTTP_WRITE_TIMEOUT, } from '../config/defaults.js';
+/**
+ * A Kubernetes request that did not return within its budget — whichever layer noticed first.
+ *
+ * TWO layers can time the same request out, and callers must not have to care which won. The Bun
+ * HTTP library arms its socket timer synchronously while the request is being issued; a wrapper
+ * added by {@link withCallDeadline} arms its timer afterwards. With equal budgets the socket timer
+ * therefore fires FIRST, so a gate that recognised only the wrapper's error would treat a genuine
+ * timeout as an ordinary failure — and a gate that fails OPEN on ordinary failures would silently
+ * skip its assertion. Both layers raise this type; {@link isRequestTimeoutError} recognises it.
+ */
+export class RequestTimeoutError extends Error {
     timeoutMs;
+    /** Structural marker, so recognition survives duplicate module instances where `instanceof` does not. */
+    isRequestTimeout = true;
+    constructor(message, timeoutMs) {
+        super(message);
+        this.name = 'RequestTimeoutError';
+        this.timeoutMs = timeoutMs;
+    }
+}
+/** True for a timeout raised by EITHER timing layer — the socket's or a {@link withCallDeadline} wrapper's. */
+export function isRequestTimeoutError(error) {
+    if (error instanceof RequestTimeoutError)
+        return true;
+    return (typeof error === 'object' &&
+        error !== null &&
+        error.isRequestTimeout === true);
+}
+/** Thrown when a readiness-poll API call exceeds its per-call budget (distinguishable so callers can fail fast vs. retry). */
+export class PollTimeoutError extends RequestTimeoutError {
     constructor(label, timeoutMs) {
         super(`${label} exceeded its ${timeoutMs}ms request timeout — the Kubernetes API call did not return. ` +
             `The usual cause is a wedged or expired kubeconfig exec credential (e.g. an AWS SSO/EKS token ` +
-            `that expired mid-deploy). Re-run with fresh credentials.`);
+            `that expired mid-deploy). Re-run with fresh credentials.`, timeoutMs);
         this.name = 'PollTimeoutError';
-        this.timeoutMs = timeoutMs;
     }
 }
 /**
@@ -75,4 +102,137 @@ export async function callWithTimeout(op, timeoutMs, label, abortSignal) {
 export function perCallTimeout(remainingMs, capMs) {
     return Math.min(capMs, remainingMs);
 }
+/** A positive, finite number, or `fallback`. Guards against `0`, `-1`, `NaN` and `Infinity`. */
+function positiveOr(value, fallback) {
+    return typeof value === 'number' && Number.isFinite(value) && value > 0 ? value : fallback;
+}
+/**
+ * Derive a per-verb budget from a caller's {@link HttpTimeoutConfig}-shaped options, each verb
+ * capped by `capMs` (normally the deployment timeout) so one request can never outlive the
+ * operation it belongs to. Non-positive / non-finite values fall back to the repo defaults —
+ * notably `timeout: 0`, which is NOT nullish and would otherwise collapse every budget to zero.
+ */
+export function callDeadlineBudget(timeouts, capMs) {
+    const cap = positiveOr(capMs, Number.POSITIVE_INFINITY);
+    // NO cross-fallback between `create` and `update`: they are separate knobs in `HttpTimeoutConfig`
+    // and each falls back only to the shared write default. Letting one stand in for the other means a
+    // caller who configured `{ create: 180_000, update: 30_000 }` silently gets 180s on every PATCH —
+    // exactly the conflation this budget exists to avoid.
+    return {
+        read: Math.min(positiveOr(timeouts?.default, DEFAULT_HTTP_READ_TIMEOUT), cap),
+        create: Math.min(positiveOr(timeouts?.create, DEFAULT_HTTP_WRITE_TIMEOUT), cap),
+        update: Math.min(positiveOr(timeouts?.update, DEFAULT_HTTP_WRITE_TIMEOUT), cap),
+        delete: Math.min(positiveOr(timeouts?.delete, DEFAULT_HTTP_DELETE_TIMEOUT), cap),
+    };
+}
+/** Method-name fragments that identify a create (POST). Matched case-insensitively. */
+const CREATE_METHOD_PATTERN = /create|post/i;
+/** Method-name fragments that identify an update (PUT / PATCH, including server-side apply). */
+const UPDATE_METHOD_PATTERN = /replace|patch|update|put|apply/i;
+/** Method-name fragments that identify a delete. Matched case-insensitively, checked FIRST. */
+const DELETE_METHOD_PATTERN = /delete|remove/i;
+/**
+ * Classify a client method by name so it is bounded by its own verb's budget, matching the split the
+ * HTTP layer already makes by method (POST → create, PUT/PATCH → update, DELETE → delete). Anything
+ * else — `read`, `list`, `get*`, `listClusterCustomObject`, and any method a future client version
+ * adds — is treated as a READ, the shortest budget. Erring toward the short budget is deliberate: a
+ * misclassified call fails fast and visibly rather than hanging. A combined name (`createOrReplace`)
+ * resolves to `create`, the verb such a helper attempts first.
+ */
+export function callDeadlineVerb(method) {
+    if (DELETE_METHOD_PATTERN.test(method))
+        return 'delete';
+    if (CREATE_METHOD_PATTERN.test(method))
+        return 'create';
+    if (UPDATE_METHOD_PATTERN.test(method))
+        return 'update';
+    return 'read';
+}
+function isThenable(value) {
+    return (typeof value === 'object' &&
+        value !== null &&
+        typeof value.then === 'function');
+}
+/**
+ * Race an already-started operation against its budget and an abort signal. Unlike
+ * {@link callWithTimeout} a non-positive / non-finite budget is allowed: the abort race still
+ * applies, only the timer is skipped. Used by {@link withCallDeadline}, where dropping the abort
+ * plumbing because a budget was misconfigured would be its own silent hang.
+ */
+function raceDeadline(operation, budgetMs, label, abortSignal) {
+    const bounded = Number.isFinite(budgetMs) && budgetMs > 0;
+    if (!bounded && !abortSignal)
+        return operation;
+    let timer;
+    let detachAbort = () => undefined;
+    const races = [operation];
+    if (bounded) {
+        races.push(new Promise((_, reject) => {
+            timer = setTimeout(() => reject(new PollTimeoutError(label, budgetMs)), budgetMs);
+        }));
+    }
+    if (abortSignal) {
+        races.push(new Promise((_, reject) => {
+            if (abortSignal.aborted) {
+                reject(abortSignal.reason ?? new DOMException('The operation was aborted', 'AbortError'));
+                return;
+            }
+            const onAbort = () => reject(abortSignal.reason ?? new DOMException('The operation was aborted', 'AbortError'));
+            abortSignal.addEventListener('abort', onAbort, { once: true });
+            detachAbort = () => abortSignal.removeEventListener('abort', onAbort);
+        }));
+    }
+    return Promise.race(races).finally(() => {
+        if (timer)
+            clearTimeout(timer);
+        detachAbort();
+    });
+}
+/**
+ * Wrap a Kubernetes API client so every request it issues is bounded by its verb's budget.
+ *
+ * Readiness polls already bound their own calls (see {@link callWithTimeout}); everything a handler
+ * does AROUND a deploy — drift checks, safety gates, CRD migrations, teardown — historically did
+ * not, so a single wedged request (a hung exec credential, a half-open socket, an API server that
+ * accepts the connection and never answers) hangs the whole reconcile with no log line and no
+ * error. Bounding at the client makes each of those calls reject with a {@link PollTimeoutError}
+ * naming the client and the method.
+ *
+ * EVERY function-valued property is wrapped, not an allow-list of known method names: a client
+ * method this module has never heard of must not silently escape the bound. A wrapped call whose
+ * return value is not thenable is handed back untouched, so synchronous helpers keep working.
+ *
+ * Same SCOPE / LIMITATION as {@link callWithTimeout}: this bounds the caller's `await`, it does not
+ * cancel the in-flight request or kill a wedged exec-auth subprocess.
+ */
+export function withCallDeadline(api, options) {
+    const { budget, label, abortSignal } = options;
+    const wrapped = new WeakMap();
+    return new Proxy(api, {
+        get(target, property) {
+            const value = Reflect.get(target, property);
+            if (typeof value !== 'function' || typeof property !== 'string')
+                return value;
+            const cached = wrapped.get(value);
+            if (cached)
+                return cached;
+            const method = value;
+            const budgetMs = budget[callDeadlineVerb(property)];
+            const bound = (...args) => {
+                // Check the signal BEFORE the call, not just inside `raceDeadline`. Racing an
+                // already-aborted signal still STARTS the request: the caller's promise rejects, but the
+                // write or delete has already left for the API server. In a replacement sequence
+                // (delete → wait for the 404 → create) an abort landing in that window would cancel the
+                // deployment and create the object anyway.
+                abortSignal?.throwIfAborted();
+                const result = method.apply(target, args);
+                if (!isThenable(result))
+                    return result;
+                return raceDeadline(result, budgetMs, `${label} ${property}`, abortSignal);
+            };
+            wrapped.set(value, bound);
+            return bound;
+        },
+    });
+}
 //# sourceMappingURL=poll-timeout.js.map

package/dist/core/deployment/poll-timeout.js.map

@@ -1 +1 @@
-{"version":3,"file":"poll-timeout.js","sourceRoot":"","sources":["../../../src/core/deployment/poll-timeout.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,8HAA8H;AAC9H,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAChC,SAAS,CAAS;IAC3B,YAAY,KAAa,EAAE,SAAiB;QAC1C,KAAK,CACH,GAAG,KAAK,iBAAiB,SAAS,+DAA+D;YAC/F,+FAA+F;YAC/F,0DAA0D,CAC7D,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,EAAoB,EACpB,SAAiB,EACjB,KAAa,EACb,WAAyB;IAEzB,IAAI,KAAgD,CAAC;IACrD,IAAI,WAAW,GAAG,GAAS,EAAE,CAAC,SAAS,CAAC;IACxC,IAAI,CAAC;QACH,WAAW,EAAE,cAAc,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;YAC/C,IAAI,CAAC,WAAW;gBAAE,OAAO;YACzB,MAAM,OAAO,GAAG,GAAG,EAAE,CACnB,MAAM,CAAC,WAAW,CAAC,MAAM,IAAI,IAAI,YAAY,CAAC,2BAA2B,EAAE,YAAY,CAAC,CAAC,CAAC;YAC5F,WAAW,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/D,WAAW,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxE,CAAC,CAAC,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC;YACxB,EAAE,EAAE;YACJ,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;gBAC/B,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,gBAAgB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;YACtF,CAAC,CAAC;YACF,OAAO;SACR,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QAC/B,WAAW,EAAE,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,WAAmB,EAAE,KAAa;IAC/D,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;AACtC,CAAC"}
+{"version":3,"file":"poll-timeout.js","sourceRoot":"","sources":["../../../src/core/deployment/poll-timeout.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EACzB,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC;AAE/B;;;;;;;;;GASG;AACH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IACnC,SAAS,CAAS;IAC3B,yGAAyG;IAChG,gBAAgB,GAAG,IAAa,CAAC;IAC1C,YAAY,OAAe,EAAE,SAAiB;QAC5C,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;CACF;AAED,+GAA+G;AAC/G,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,IAAI,KAAK,YAAY,mBAAmB;QAAE,OAAO,IAAI,CAAC;IACtD,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACb,KAAwC,CAAC,gBAAgB,KAAK,IAAI,CACpE,CAAC;AACJ,CAAC;AAED,8HAA8H;AAC9H,MAAM,OAAO,gBAAiB,SAAQ,mBAAmB;IACvD,YAAY,KAAa,EAAE,SAAiB;QAC1C,KAAK,CACH,GAAG,KAAK,iBAAiB,SAAS,+DAA+D;YAC/F,+FAA+F;YAC/F,0DAA0D,EAC5D,SAAS,CACV,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,EAAoB,EACpB,SAAiB,EACjB,KAAa,EACb,WAAyB;IAEzB,IAAI,KAAgD,CAAC;IACrD,IAAI,WAAW,GAAG,GAAS,EAAE,CAAC,SAAS,CAAC;IACxC,IAAI,CAAC;QACH,WAAW,EAAE,cAAc,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;YAC/C,IAAI,CAAC,WAAW;gBAAE,OAAO;YACzB,MAAM,OAAO,GAAG,GAAG,EAAE,CACnB,MAAM,CAAC,WAAW,CAAC,MAAM,IAAI,IAAI,YAAY,CAAC,2BAA2B,EAAE,YAAY,CAAC,CAAC,CAAC;YAC5F,WAAW,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/D,WAAW,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxE,CAAC,CAAC,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC;YACxB,EAAE,EAAE;YACJ,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;gBAC/B,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,gBAAgB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;YACtF,CAAC,CAAC;YACF,OAAO;SACR,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QAC/B,WAAW,EAAE,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,WAAmB,EAAE,KAAa;IAC/D,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;AACtC,CAAC;AAqBD,gGAAgG;AAChG,SAAS,UAAU,CAAC,KAAyB,EAAE,QAAgB;IAC7D,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC7F,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAOa,EACb,KAAc;IAEd,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC;IACxD,kGAAkG;IAClG,mGAAmG;IACnG,kGAAkG;IAClG,sDAAsD;IACtD,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,EAAE,OAAO,EAAE,yBAAyB,CAAC,EAAE,GAAG,CAAC;QAC7E,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,0BAA0B,CAAC,EAAE,GAAG,CAAC;QAC/E,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,0BAA0B,CAAC,EAAE,GAAG,CAAC;QAC/E,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,2BAA2B,CAAC,EAAE,GAAG,CAAC;KACjF,CAAC;AACJ,CAAC;AAED,uFAAuF;AACvF,MAAM,qBAAqB,GAAG,cAAc,CAAC;AAC7C,gGAAgG;AAChG,MAAM,qBAAqB,GAAG,iCAAiC,CAAC;AAChE,+FAA+F;AAC/F,MAAM,qBAAqB,GAAG,gBAAgB,CAAC;AAE/C;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAC7C,IAAI,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,QAAQ,CAAC;IACxD,IAAI,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,QAAQ,CAAC;IACxD,IAAI,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,QAAQ,CAAC;IACxD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,OAAQ,KAA4B,CAAC,IAAI,KAAK,UAAU,CACzD,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CACnB,SAAqB,EACrB,QAAgB,EAChB,KAAa,EACb,WAAyB;IAEzB,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,CAAC;IAC1D,IAAI,CAAC,OAAO,IAAI,CAAC,WAAW;QAAE,OAAO,SAAS,CAAC;IAC/C,IAAI,KAAgD,CAAC;IACrD,IAAI,WAAW,GAAG,GAAS,EAAE,CAAC,SAAS,CAAC;IACxC,MAAM,KAAK,GAAiB,CAAC,SAAS,CAAC,CAAC;IACxC,IAAI,OAAO,EAAE,CAAC;QACZ,KAAK,CAAC,IAAI,CACR,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;YAC/B,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,gBAAgB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QACpF,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;IACD,IAAI,WAAW,EAAE,CAAC;QAChB,KAAK,CAAC,IAAI,CACR,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;YAC/B,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;gBACxB,MAAM,CAAC,WAAW,CAAC,MAAM,IAAI,IAAI,YAAY,CAAC,2BAA2B,EAAE,YAAY,CAAC,CAAC,CAAC;gBAC1F,OAAO;YACT,CAAC;YACD,MAAM,OAAO,GAAG,GAAG,EAAE,CACnB,MAAM,CAAC,WAAW,CAAC,MAAM,IAAI,IAAI,YAAY,CAAC,2BAA2B,EAAE,YAAY,CAAC,CAAC,CAAC;YAC5F,WAAW,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/D,WAAW,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxE,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;QACtC,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QAC/B,WAAW,EAAE,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,GAAM,EACN,OAIC;IAED,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;IAC/C,MAAM,OAAO,GAAG,IAAI,OAAO,EAAmB,CAAC;IAC/C,OAAO,IAAI,KAAK,CAAC,GAAG,EAAE;QACpB,GAAG,CAAC,MAAM,EAAE,QAAQ;YAClB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAC5C,IAAI,OAAO,KAAK,KAAK,UAAU,IAAI,OAAO,QAAQ,KAAK,QAAQ;gBAAE,OAAO,KAAK,CAAC;YAC9E,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAClC,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;YAC1B,MAAM,MAAM,GAAG,KAAwC,CAAC;YACxD,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;YACpD,MAAM,KAAK,GAAG,CAAC,GAAG,IAAe,EAAW,EAAE;gBAC5C,8EAA8E;gBAC9E,yFAAyF;gBACzF,iFAAiF;gBACjF,wFAAwF;gBACxF,2CAA2C;gBAC3C,WAAW,EAAE,cAAc,EAAE,CAAC;gBAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBAC1C,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;oBAAE,OAAO,MAAM,CAAC;gBACvC,OAAO,YAAY,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,IAAI,QAAQ,EAAE,EAAE,WAAW,CAAC,CAAC;YAC7E,CAAC,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YAC1B,OAAO,KAAK,CAAC;QACf,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/core/kubernetes/bun-http-library.d.ts

@@ -13,6 +13,7 @@
  */
 import type { HttpLibrary, RequestContext, ResponseContext } from '@kubernetes/client-node/dist/gen/http/http.js';
 import { type Observable } from '@kubernetes/client-node/dist/gen/rxjsStub.js';
+import { RequestTimeoutError } from '../deployment/poll-timeout.js';
 /**
  * Configuration for HTTP request timeouts by operation type.
  *
@@ -72,6 +73,29 @@ export interface AgentTlsOptions {
     servername?: string;
     ciphers?: string;
 }
+/**
+ * The transport dropped before the response was complete.
+ *
+ * WHY THIS TYPE EXISTS: a request whose socket dies mid-response must REJECT, and must reject as
+ * something callers already understand. It is modelled as a {@link RequestTimeoutError} because the
+ * caller's situation is identical to a timeout — the call did not return an answer — so gates that
+ * fail CLOSED on a wedged call (they must not read "no answer" as "nothing is there") keep working
+ * without knowing this class exists. `code` is `ECONNRESET` and the message contains
+ * `socket hang up`, the two shapes the transient/retryable classifiers already match on, so a
+ * retry loop treats it as the transient transport blip it usually is.
+ *
+ * NOTE ON `timeoutMs`: nothing here EXPIRED — the socket died with budget to spare, typically in
+ * milliseconds out of minutes. The inherited field therefore carries how long the request actually
+ * ran ({@link elapsedMs}), never the configured budget, so a log line or a retry heuristic reading
+ * it cannot conclude that the deadline was reached.
+ */
+export declare class PrematureCloseError extends RequestTimeoutError {
+    /** Node's system-error code for a peer-reset socket; transient-error classifiers match on it. */
+    readonly code: "ECONNRESET";
+    /** How long the request ran before the transport died. Same value as the inherited `timeoutMs`. */
+    readonly elapsedMs: number;
+    constructor(method: string, path: string, elapsedMs: number, phase: string, cause?: unknown);
+}
 /** Extract the TLS material KubeConfig placed on an https.Agent. */
 export declare function extractAgentTlsOptions(agent: unknown): AgentTlsOptions;
 /**

package/dist/core/kubernetes/bun-http-library.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bun-http-library.d.ts","sourceRoot":"","sources":["../../../src/core/kubernetes/bun-http-library.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,OAAO,KAAK,EACV,WAAW,EACX,cAAc,EACd,eAAe,EAChB,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAQ,KAAK,UAAU,EAAE,MAAM,8CAA8C,CAAC;AASrF;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACvB,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACtB,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC;IAC9C,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,oEAAoE;AACpE,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,eAAe,CAItE;AAcD;;GAEG;AACH,wBAAgB,YAAY,IAAI,OAAO,CAEtC;AAED;;;;;;;;GAQG;AACH,qBAAa,wBAAyB,YAAW,WAAW;IAC1D,OAAO,CAAC,QAAQ,CAA8B;IAC9C,OAAO,CAAC,MAAM,CAA0C;IAExD;;;OAGG;gBACS,aAAa,CAAC,EAAE,iBAAiB;IAkBtC,IAAI,CAAC,OAAO,EAAE,cAAc,GAAG,UAAU,CAAC,eAAe,CAAC;IAKjE;;;;;;;OAOG;IACH,OAAO,CAAC,oBAAoB;IAyB5B,OAAO,CAAC,WAAW;CA8KpB;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CACtC,aAAa,CAAC,EAAE,iBAAiB,GAChC,WAAW,GAAG,SAAS,CAKzB;AAGD,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,eAAe,EAAE,CAAC"}
+{"version":3,"file":"bun-http-library.d.ts","sourceRoot":"","sources":["../../../src/core/kubernetes/bun-http-library.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,OAAO,KAAK,EACV,WAAW,EACX,cAAc,EACd,eAAe,EAChB,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAQ,KAAK,UAAU,EAAE,MAAM,8CAA8C,CAAC;AAOrF,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAGpE;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACvB,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACtB,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC;IAC9C,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,mBAAoB,SAAQ,mBAAmB;IAC1D,iGAAiG;IACjG,QAAQ,CAAC,IAAI,EAAG,YAAY,CAAU;IACtC,mGAAmG;IACnG,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;gBACf,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;CAc5F;AAED,oEAAoE;AACpE,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,eAAe,CAItE;AAcD;;GAEG;AACH,wBAAgB,YAAY,IAAI,OAAO,CAEtC;AAED;;;;;;;;GAQG;AACH,qBAAa,wBAAyB,YAAW,WAAW;IAC1D,OAAO,CAAC,QAAQ,CAA8B;IAC9C,OAAO,CAAC,MAAM,CAA0C;IAExD;;;OAGG;gBACS,aAAa,CAAC,EAAE,iBAAiB;IAkBtC,IAAI,CAAC,OAAO,EAAE,cAAc,GAAG,UAAU,CAAC,eAAe,CAAC;IAKjE;;;;;;;OAOG;IACH,OAAO,CAAC,oBAAoB;IAyB5B,OAAO,CAAC,WAAW;CA2QpB;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CACtC,aAAa,CAAC,EAAE,iBAAiB,GAChC,WAAW,GAAG,SAAS,CAKzB;AAGD,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,eAAe,EAAE,CAAC"}

package/dist/core/kubernetes/bun-http-library.js

@@ -15,7 +15,42 @@ import * as http from 'node:http';
 import * as https from 'node:https';
 import { from } from '@kubernetes/client-node/dist/gen/rxjsStub.js';
 import { DEFAULT_HTTP_DELETE_TIMEOUT, DEFAULT_HTTP_READ_TIMEOUT, DEFAULT_HTTP_WATCH_TIMEOUT, DEFAULT_HTTP_WRITE_TIMEOUT, } from '../config/defaults.js';
+import { RequestTimeoutError } from '../deployment/poll-timeout.js';
 import { getComponentLogger } from '../logging/index.js';
+/**
+ * The transport dropped before the response was complete.
+ *
+ * WHY THIS TYPE EXISTS: a request whose socket dies mid-response must REJECT, and must reject as
+ * something callers already understand. It is modelled as a {@link RequestTimeoutError} because the
+ * caller's situation is identical to a timeout — the call did not return an answer — so gates that
+ * fail CLOSED on a wedged call (they must not read "no answer" as "nothing is there") keep working
+ * without knowing this class exists. `code` is `ECONNRESET` and the message contains
+ * `socket hang up`, the two shapes the transient/retryable classifiers already match on, so a
+ * retry loop treats it as the transient transport blip it usually is.
+ *
+ * NOTE ON `timeoutMs`: nothing here EXPIRED — the socket died with budget to spare, typically in
+ * milliseconds out of minutes. The inherited field therefore carries how long the request actually
+ * ran ({@link elapsedMs}), never the configured budget, so a log line or a retry heuristic reading
+ * it cannot conclude that the deadline was reached.
+ */
+export class PrematureCloseError extends RequestTimeoutError {
+    /** Node's system-error code for a peer-reset socket; transient-error classifiers match on it. */
+    code = 'ECONNRESET';
+    /** How long the request ran before the transport died. Same value as the inherited `timeoutMs`. */
+    elapsedMs;
+    constructor(method, path, elapsedMs, phase, cause) {
+        super(`socket hang up: the connection closed before the response completed (${method} ${path}) — ${phase}.\n` +
+            `The connection lasted ${elapsedMs}ms; its budget had not expired.\n` +
+            (cause instanceof Error ? `Underlying transport error: ${cause.message}\n` : '') +
+            `\n` +
+            `The Kubernetes API server, or something between it and this client (load balancer, proxy, ` +
+            `NAT gateway), dropped the connection mid-flight. This is usually transient; retry.`, elapsedMs);
+        this.name = 'PrematureCloseError';
+        this.elapsedMs = elapsedMs;
+        if (cause !== undefined)
+            this.cause = cause;
+    }
+}
 /** Extract the TLS material KubeConfig placed on an https.Agent. */
 export function extractAgentTlsOptions(agent) {
     return agent && typeof agent === 'object' && 'options' in agent
@@ -155,13 +190,45 @@ export class BunCompatibleHttpLibrary {
                     timeoutId = undefined;
                 }
             };
+            // Detaching the abort listener, if one was attached. Assigned when the signal is wired up
+            // below; a no-op until then, so the latch can always call it.
+            let detachAbort = () => undefined;
+            // EVERY terminal path goes through here, and the FIRST one wins. Resolve/reject are latched so
+            // a socket teardown that emits several events in a row (`aborted`, then `error`, then `close`)
+            // cannot settle twice, and — the bug this guards — so no path can disarm the timer WITHOUT
+            // settling. Clearing the timer is the guard's job alone; nothing else touches it. Releasing the
+            // abort listener belongs here for the same reason: it is per-request state on a signal that
+            // usually OUTLIVES the request.
+            let settled = false;
+            const settle = (finish) => {
+                if (settled)
+                    return;
+                settled = true;
+                clearRequestTimeout();
+                detachAbort();
+                finish();
+            };
+            // Bun's `node:http` emits the REQUEST's 'close' as soon as the response headers arrive, long
+            // before the body is done (Node emits it after the exchange ends). So 'close' on the request
+            // only means "the exchange ended" while no response has begun; once one has, the response's own
+            // terminal events are what tell us whether it completed.
+            let responseStarted = false;
+            // The elapsed time, not the budget: a premature close happens with budget to spare, and the
+            // error must not read as "the deadline was reached". See {@link PrematureCloseError}.
+            const issuedAt = Date.now();
+            const failPrematureClose = (phase, cause) => settle(() => reject(new PrematureCloseError(method, url.pathname, Date.now() - issuedAt, phase, cause)));
             const req = httpModule.request(options, (res) => {
+                responseStarted = true;
                 const chunks = [];
                 res.on('data', (chunk) => {
                     chunks.push(chunk);
                 });
+                // The socket died with the body half-delivered. Unhandled, these leave the promise pending
+                // FOREVER: 'end' never fires, and the request's 'error' does not fire either.
+                res.on('aborted', () => failPrematureClose('the response body was truncated'));
+                res.on('error', (err) => failPrematureClose('the response stream failed', err));
+                res.on('close', () => failPrematureClose('the response stream closed before it ended'));
                 res.on('end', () => {
-                    clearRequestTimeout();
                     const buffer = Buffer.concat(chunks);
                     const responseHeaders = {};
                     // Convert headers to simple object
@@ -196,12 +263,11 @@ export class BunCompatibleHttpLibrary {
                             }
                         },
                     };
-                    resolve(response);
+                    settle(() => resolve(response));
                 });
             });
             req.on('error', (err) => {
-                clearRequestTimeout();
-                reject(err);
+                settle(() => reject(err));
             });
             req.on('socket', (socket) => {
                 // Prevent idle client sockets from keeping short-lived CLI processes alive.
@@ -215,8 +281,11 @@ export class BunCompatibleHttpLibrary {
             // Watch operations are handled by the API server via timeoutSeconds parameter
             if (shouldSetTimeout) {
                 timeoutId = setTimeout(() => {
-                    req.destroy(); // Abort the request
-                    const timeoutError = new Error(`HTTP request timeout: ${method} ${url.pathname} timed out after ${timeoutMs}ms\n` +
+                    // A TYPED timeout (not a bare Error): this timer is armed synchronously as the request is
+                    // issued, so with equal budgets it fires BEFORE any deadline wrapper around the call and
+                    // is the error a caller actually sees. A gate that fails open on ordinary failures must be
+                    // able to tell this apart from "the object does not exist". See `isRequestTimeoutError`.
+                    const timeoutError = new RequestTimeoutError(`HTTP request timeout: ${method} ${url.pathname} timed out after ${timeoutMs}ms\n` +
                         `URL: ${url.toString()}\n` +
                         `\n` +
                         `💡 Possible causes:\n` +
@@ -229,29 +298,87 @@ export class BunCompatibleHttpLibrary {
                         `  • Verify Kubernetes API server is running: kubectl cluster-info\n` +
                         `  • Check webhook status: kubectl get validatingwebhookconfigurations\n` +
                         `  • Increase timeout via httpTimeouts option if needed\n` +
-                        `  • For watch operations: timeouts are disabled (API server controls via timeoutSeconds)`);
-                    reject(timeoutError);
+                        `  • For watch operations: timeouts are disabled (API server controls via timeoutSeconds)`, timeoutMs);
+                    // Settle BEFORE tearing the socket down: `req.destroy()` emits 'error'/'close', and the
+                    // caller must see the timeout — not the ECONNRESET our own abort produced. The latch makes
+                    // that teardown a no-op.
+                    settle(() => reject(timeoutError));
+                    req.destroy();
                 }, timeoutMs);
+                // Belt and braces for the pre-connect phase. The wall-clock timer above is armed
+                // synchronously, so it already covers a DNS or TCP/TLS connect that never completes — but it
+                // can only bound the caller's `await`; it cannot guarantee the runtime actually releases a
+                // socket still stuck in connect. `setTimeout` on the request tears that socket down from the
+                // inside. It is an IDLE timer, so on a live connection it can never fire before the wall
+                // clock, which means it never shortens a legitimately slow request.
+                req.setTimeout(timeoutMs, () => {
+                    req.destroy();
+                });
             }
             // Handle abort signal (if available - added in newer versions).
-            // Use { once: true } to automatically remove the listener after firing,
-            // preventing memory growth when the AbortSignal outlives the request.
+            //
+            // `{ once: true }` alone is NOT enough to bound the listener's lifetime: it removes the
+            // listener when the event FIRES, and the overwhelmingly common case is that it never fires
+            // because the request succeeded. A caller's signal typically spans a whole converge — hundreds
+            // of requests — so every completed request left its closure (and the `req` it captures)
+            // attached, growing the signal's listener list for the life of the operation. Detaching is
+            // therefore done by the latch, which every terminal path goes through, with `{ once: true }`
+            // kept as belt and braces for the firing case.
             const getSignal = Reflect.get(request, 'getSignal');
             const signal = getSignal?.();
             if (signal) {
-                signal.addEventListener('abort', () => {
-                    clearRequestTimeout();
-                    req.destroy(new Error('Request aborted'));
-                }, { once: true });
+                const onAbort = () => {
+                    settle(() => reject(signal.reason ?? new Error('Request aborted')));
+                    req.destroy();
+                };
+                // An ALREADY-aborted signal never fires 'abort' again, so a listener alone silently misses
+                // it and the request goes out anyway — the exact opposite of what the caller asked for.
+                // A signal is routinely already aborted by the time a request is issued: a converge-wide
+                // signal trips while an earlier call is in flight, and the next call in the queue is built
+                // against it. Reject up front and tear the half-built request down BEFORE `req.end()` puts
+                // any bytes on the wire.
+                if (signal.aborted) {
+                    settle(() => reject(signal.reason ?? new DOMException('The operation was aborted', 'AbortError')));
+                    req.destroy();
+                }
+                else {
+                    signal.addEventListener('abort', onAbort, { once: true });
+                    detachAbort = () => signal.removeEventListener('abort', onAbort);
+                }
             }
+            // The request ended without the promise having settled. On Bun this fires as soon as the
+            // response headers land, so it is only terminal while NO response has started; after that the
+            // response's own 'aborted'/'error'/'close' are the terminal events. Either way the timer stays
+            // armed until something settles — clearing it here WITHOUT settling was the hang.
             req.on('close', () => {
-                clearRequestTimeout();
+                if (responseStarted)
+                    return;
+                failPrematureClose('the socket closed before any response was received');
             });
-            // Send body if present
-            if (body) {
-                req.write(body);
+            // Send body if present.
+            //
+            // These can throw SYNCHRONOUSLY — `write` rejects a body that is not a string or Buffer with
+            // ERR_INVALID_ARG_TYPE, for instance. A throw here escapes the Promise executor, which rejects
+            // the promise for us but does NOT run the latch, so the timer would stay armed and hold a
+            // short-lived CLI process open for its whole budget after the call had already failed. Route
+            // it through the latch instead, and tear the half-issued request down.
+            //
+            // A signal that was ALREADY aborted has settled the promise and destroyed the request above;
+            // there is nothing left to send, and writing to a destroyed request would only raise a
+            // spurious ERR_STREAM_DESTROYED. Returning here is also what keeps the promise's contract
+            // honest: the server never sees a request the caller had already cancelled.
+            if (settled)
+                return;
+            try {
+                if (body) {
+                    req.write(body);
+                }
+                req.end();
+            }
+            catch (err) {
+                settle(() => reject(err));
+                req.destroy();
             }
-            req.end();
         });
     }
 }

package/dist/core/kubernetes/bun-http-library.js.map

@@ -1 +1 @@
-{"version":3,"file":"bun-http-library.js","sourceRoot":"","sources":["../../../src/core/kubernetes/bun-http-library.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,KAAK,MAAM,YAAY,CAAC;AAMpC,OAAO,EAAE,IAAI,EAAmB,MAAM,8CAA8C,CAAC;AACrF,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EACzB,0BAA0B,EAC1B,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAmEzD,oEAAoE;AACpE,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,OAAO,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,SAAS,IAAI,KAAK;QAC7D,CAAC,CAAE,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAqB;QACpD,CAAC,CAAC,EAAE,CAAC;AACT,CAAC;AAED;;;GAGG;AACH,MAAM,gBAAgB,GAAgC;IACpD,OAAO,EAAE,yBAAyB;IAClC,KAAK,EAAE,0BAA0B,EAAE,qEAAqE;IACxG,MAAM,EAAE,0BAA0B,EAAE,6CAA6C;IACjF,MAAM,EAAE,0BAA0B,EAAE,6CAA6C;IACjF,MAAM,EAAE,2BAA2B,EAAE,8CAA8C;CACpF,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,YAAY;IAC1B,OAAO,OAAO,GAAG,KAAK,WAAW,CAAC;AACpC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,wBAAwB;IAC3B,QAAQ,CAA8B;IACtC,MAAM,GAAG,kBAAkB,CAAC,kBAAkB,CAAC,CAAC;IAExD;;;OAGG;IACH,YAAY,aAAiC;QAC3C,IAAI,CAAC,QAAQ,GAAG;YACd,GAAG,gBAAgB;YACnB,GAAG,aAAa;SACjB,CAAC;QAEF,gDAAgD;QAChD,IAAI,YAAY,EAAE,EAAE,CAAC;YACnB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oDAAoD,EAAE;gBACtE,OAAO,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI;gBACrC,KAAK,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI;gBACjC,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI;gBACnC,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI;gBACnC,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI;aACpC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEM,IAAI,CAAC,OAAuB;QACjC,MAAM,aAAa,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAChD,OAAO,IAAI,CAAC,aAAa,CAAC,CAAC;IAC7B,CAAC;IAED;;;;;;;OAOG;IACK,oBAAoB,CAAC,MAAc,EAAE,GAAW;QACtD,0EAA0E;QAC1E,uEAAuE;QACvE,uEAAuE;QACvE,kEAAkE;QAClE,IAAI,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YAC/D,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC7B,CAAC;QAED,mDAAmD;QACnD,wEAAwE;QACxE,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QACzC,QAAQ,WAAW,EAAE,CAAC;YACpB,KAAK,MAAM;gBACT,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC9B,KAAK,OAAO,CAAC;YACb,KAAK,KAAK;gBACR,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC9B,KAAK,QAAQ;gBACX,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC9B;gBACE,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QACjC,CAAC;IACH,CAAC;IAEO,WAAW,CAAC,OAAuB;QACzC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YACtC,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;YACvC,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC;YAC1C,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;YAE1C,iDAAiD;YACjD,MAAM,SAAS,GAAG,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;YAEpE,8EAA8E;YAC9E,MAAM,gBAAgB,GACpB,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;YAErF,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;YACjC,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;YAE/B,gDAAgD;YAChD,0DAA0D;YAC1D,4EAA4E;YAC5E,MAAM,YAAY,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;YAEnD,MAAM,OAAO,GAAyB;gBACpC,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtC,IAAI,EAAE,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM;gBAC/B,MAAM,EAAE,MAAM;gBACd,qEAAqE;gBACrE,yEAAyE;gBACzE,mEAAmE;gBACnE,KAAK,EAAE,KAAK;gBACZ,OAAO,EAAE;oBACP,UAAU,EAAE,OAAO;oBACnB,GAAG,OAAO;iBACX;gBACD,mDAAmD;gBACnD,kDAAkD;gBAClD,kBAAkB,EAAE,YAAY,CAAC,kBAAkB,IAAI,IAAI;gBAC3D,IAAI,EAAE,YAAY,CAAC,IAAI;gBACvB,GAAG,EAAE,YAAY,CAAC,GAAG;gBACrB,EAAE,EAAE,YAAY,CAAC,EAAE;gBACnB,2CAA2C;gBAC3C,GAAG,EAAE,YAAY,CAAC,GAAG;gBACrB,UAAU,EAAE,YAAY,CAAC,UAAU;gBACnC,UAAU,EAAE,YAAY,CAAC,UAAU;gBACnC,OAAO,EAAE,YAAY,CAAC,OAAO;aAC9B,CAAC;YAEF,IAAI,SAAqC,CAAC;YAC1C,MAAM,mBAAmB,GAAG,GAAG,EAAE;gBAC/B,IAAI,SAAS,EAAE,CAAC;oBACd,YAAY,CAAC,SAAS,CAAC,CAAC;oBACxB,SAAS,GAAG,SAAS,CAAC;gBACxB,CAAC;YACH,CAAC,CAAC;YAEF,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBAC9C,MAAM,MAAM,GAAa,EAAE,CAAC;gBAE5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;oBAC/B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACrB,CAAC,CAAC,CAAC;gBAEH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;oBACjB,mBAAmB,EAAE,CAAC;oBACtB,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;oBACrC,MAAM,eAAe,GAA2B,EAAE,CAAC;oBAEnD,mCAAmC;oBACnC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;wBACvD,IAAI,KAAK,EAAE,CAAC;4BACV,eAAe,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;wBACzE,CAAC;oBACH,CAAC;oBAED,sEAAsE;oBACtE,8DAA8D;oBAC9D,MAAM,YAAY,GAAG;wBACnB,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;wBACrD,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;qBACtC,CAAC;oBAEF,gEAAgE;oBAChE,oEAAoE;oBACpE,MAAM,QAAQ,GAAG;wBACf,cAAc,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC;wBACnC,OAAO,EAAE,eAAe;wBACxB,IAAI,EAAE,YAAY;wBAClB,gEAAgE;wBAChE,YAAY,EAAE,KAAK,IAAI,EAAE;4BACvB,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;4BACtC,IAAI,CAAC;gCACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;4BAC1B,CAAC;4BAAC,OAAO,KAAc,EAAE,CAAC;gCACxB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,2DAA2D,EAAE;oCAC7E,GAAG,EAAE,KAAK;iCACX,CAAC,CAAC;gCACH,OAAO,IAAI,CAAC;4BACd,CAAC;wBACH,CAAC;qBACF,CAAC;oBAEF,OAAO,CAAC,QAA2B,CAAC,CAAC;gBACvC,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBACtB,mBAAmB,EAAE,CAAC;gBACtB,MAAM,CAAC,GAAG,CAAC,CAAC;YACd,CAAC,CAAC,CAAC;YAEH,GAAG,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,EAAE;gBAC1B,4EAA4E;gBAC5E,4EAA4E;gBAC5E,yDAAyD;gBACzD,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,CAAC,CAAC,CAAC;YAEH,yDAAyD;YACzD,qEAAqE;YACrE,4EAA4E;YAC5E,8EAA8E;YAC9E,IAAI,gBAAgB,EAAE,CAAC;gBACrB,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE;oBAC1B,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,oBAAoB;oBACnC,MAAM,YAAY,GAAG,IAAI,KAAK,CAC5B,yBAAyB,MAAM,IAAI,GAAG,CAAC,QAAQ,oBAAoB,SAAS,MAAM;wBAChF,QAAQ,GAAG,CAAC,QAAQ,EAAE,IAAI;wBAC1B,IAAI;wBACJ,uBAAuB;wBACvB,+CAA+C;wBAC/C,kDAAkD;wBAClD,mCAAmC;wBACnC,6DAA6D;wBAC7D,IAAI;wBACJ,gBAAgB;wBAChB,qEAAqE;wBACrE,yEAAyE;wBACzE,0DAA0D;wBAC1D,0FAA0F,CAC7F,CAAC;oBACF,MAAM,CAAC,YAAY,CAAC,CAAC;gBACvB,CAAC,EAAE,SAAS,CAAC,CAAC;YAChB,CAAC;YAED,gEAAgE;YAChE,wEAAwE;YACxE,sEAAsE;YACtE,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAoC,CAAC;YACvF,MAAM,MAAM,GAAG,SAAS,EAAE,EAAE,CAAC;YAC7B,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,CAAC,gBAAgB,CACrB,OAAO,EACP,GAAG,EAAE;oBACH,mBAAmB,EAAE,CAAC;oBACtB,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC;gBAC5C,CAAC,EACD,EAAE,IAAI,EAAE,IAAI,EAAE,CACf,CAAC;YACJ,CAAC;YAED,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBACnB,mBAAmB,EAAE,CAAC;YACxB,CAAC,CAAC,CAAC;YAEH,uBAAuB;YACvB,IAAI,IAAI,EAAE,CAAC;gBACT,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAClB,CAAC;YAED,GAAG,CAAC,GAAG,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CACtC,aAAiC;IAEjC,IAAI,YAAY,EAAE,EAAE,CAAC;QACnB,OAAO,IAAI,wBAAwB,CAAC,aAAa,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}
+{"version":3,"file":"bun-http-library.js","sourceRoot":"","sources":["../../../src/core/kubernetes/bun-http-library.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,KAAK,MAAM,YAAY,CAAC;AAMpC,OAAO,EAAE,IAAI,EAAmB,MAAM,8CAA8C,CAAC;AACrF,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EACzB,0BAA0B,EAC1B,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAmEzD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,mBAAoB,SAAQ,mBAAmB;IAC1D,iGAAiG;IACxF,IAAI,GAAG,YAAqB,CAAC;IACtC,mGAAmG;IAC1F,SAAS,CAAS;IAC3B,YAAY,MAAc,EAAE,IAAY,EAAE,SAAiB,EAAE,KAAa,EAAE,KAAe;QACzF,KAAK,CACH,wEAAwE,MAAM,IAAI,IAAI,OAAO,KAAK,KAAK;YACrG,yBAAyB,SAAS,mCAAmC;YACrE,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,+BAA+B,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAChF,IAAI;YACJ,4FAA4F;YAC5F,oFAAoF,EACtF,SAAS,CACV,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,KAAK,KAAK,SAAS;YAAE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IAC9C,CAAC;CACF;AAED,oEAAoE;AACpE,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,OAAO,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,SAAS,IAAI,KAAK;QAC7D,CAAC,CAAE,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAqB;QACpD,CAAC,CAAC,EAAE,CAAC;AACT,CAAC;AAED;;;GAGG;AACH,MAAM,gBAAgB,GAAgC;IACpD,OAAO,EAAE,yBAAyB;IAClC,KAAK,EAAE,0BAA0B,EAAE,qEAAqE;IACxG,MAAM,EAAE,0BAA0B,EAAE,6CAA6C;IACjF,MAAM,EAAE,0BAA0B,EAAE,6CAA6C;IACjF,MAAM,EAAE,2BAA2B,EAAE,8CAA8C;CACpF,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,YAAY;IAC1B,OAAO,OAAO,GAAG,KAAK,WAAW,CAAC;AACpC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,wBAAwB;IAC3B,QAAQ,CAA8B;IACtC,MAAM,GAAG,kBAAkB,CAAC,kBAAkB,CAAC,CAAC;IAExD;;;OAGG;IACH,YAAY,aAAiC;QAC3C,IAAI,CAAC,QAAQ,GAAG;YACd,GAAG,gBAAgB;YACnB,GAAG,aAAa;SACjB,CAAC;QAEF,gDAAgD;QAChD,IAAI,YAAY,EAAE,EAAE,CAAC;YACnB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oDAAoD,EAAE;gBACtE,OAAO,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI;gBACrC,KAAK,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI;gBACjC,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI;gBACnC,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI;gBACnC,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI;aACpC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEM,IAAI,CAAC,OAAuB;QACjC,MAAM,aAAa,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAChD,OAAO,IAAI,CAAC,aAAa,CAAC,CAAC;IAC7B,CAAC;IAED;;;;;;;OAOG;IACK,oBAAoB,CAAC,MAAc,EAAE,GAAW;QACtD,0EAA0E;QAC1E,uEAAuE;QACvE,uEAAuE;QACvE,kEAAkE;QAClE,IAAI,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YAC/D,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC7B,CAAC;QAED,mDAAmD;QACnD,wEAAwE;QACxE,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QACzC,QAAQ,WAAW,EAAE,CAAC;YACpB,KAAK,MAAM;gBACT,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC9B,KAAK,OAAO,CAAC;YACb,KAAK,KAAK;gBACR,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC9B,KAAK,QAAQ;gBACX,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC9B;gBACE,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QACjC,CAAC;IACH,CAAC;IAEO,WAAW,CAAC,OAAuB;QACzC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YACtC,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;YACvC,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC;YAC1C,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;YAE1C,iDAAiD;YACjD,MAAM,SAAS,GAAG,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;YAEpE,8EAA8E;YAC9E,MAAM,gBAAgB,GACpB,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;YAErF,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;YACjC,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;YAE/B,gDAAgD;YAChD,0DAA0D;YAC1D,4EAA4E;YAC5E,MAAM,YAAY,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;YAEnD,MAAM,OAAO,GAAyB;gBACpC,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtC,IAAI,EAAE,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM;gBAC/B,MAAM,EAAE,MAAM;gBACd,qEAAqE;gBACrE,yEAAyE;gBACzE,mEAAmE;gBACnE,KAAK,EAAE,KAAK;gBACZ,OAAO,EAAE;oBACP,UAAU,EAAE,OAAO;oBACnB,GAAG,OAAO;iBACX;gBACD,mDAAmD;gBACnD,kDAAkD;gBAClD,kBAAkB,EAAE,YAAY,CAAC,kBAAkB,IAAI,IAAI;gBAC3D,IAAI,EAAE,YAAY,CAAC,IAAI;gBACvB,GAAG,EAAE,YAAY,CAAC,GAAG;gBACrB,EAAE,EAAE,YAAY,CAAC,EAAE;gBACnB,2CAA2C;gBAC3C,GAAG,EAAE,YAAY,CAAC,GAAG;gBACrB,UAAU,EAAE,YAAY,CAAC,UAAU;gBACnC,UAAU,EAAE,YAAY,CAAC,UAAU;gBACnC,OAAO,EAAE,YAAY,CAAC,OAAO;aAC9B,CAAC;YAEF,IAAI,SAAqC,CAAC;YAC1C,MAAM,mBAAmB,GAAG,GAAG,EAAE;gBAC/B,IAAI,SAAS,EAAE,CAAC;oBACd,YAAY,CAAC,SAAS,CAAC,CAAC;oBACxB,SAAS,GAAG,SAAS,CAAC;gBACxB,CAAC;YACH,CAAC,CAAC;YAEF,0FAA0F;YAC1F,8DAA8D;YAC9D,IAAI,WAAW,GAAG,GAAS,EAAE,CAAC,SAAS,CAAC;YAExC,+FAA+F;YAC/F,+FAA+F;YAC/F,2FAA2F;YAC3F,gGAAgG;YAChG,4FAA4F;YAC5F,gCAAgC;YAChC,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,MAAM,MAAM,GAAG,CAAC,MAAkB,EAAQ,EAAE;gBAC1C,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,mBAAmB,EAAE,CAAC;gBACtB,WAAW,EAAE,CAAC;gBACd,MAAM,EAAE,CAAC;YACX,CAAC,CAAC;YAEF,6FAA6F;YAC7F,6FAA6F;YAC7F,gGAAgG;YAChG,yDAAyD;YACzD,IAAI,eAAe,GAAG,KAAK,CAAC;YAC5B,4FAA4F;YAC5F,sFAAsF;YACtF,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC5B,MAAM,kBAAkB,GAAG,CAAC,KAAa,EAAE,KAAe,EAAE,EAAE,CAC5D,MAAM,CAAC,GAAG,EAAE,CACV,MAAM,CAAC,IAAI,mBAAmB,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAC3F,CAAC;YAEJ,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBAC9C,eAAe,GAAG,IAAI,CAAC;gBACvB,MAAM,MAAM,GAAa,EAAE,CAAC;gBAE5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;oBAC/B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACrB,CAAC,CAAC,CAAC;gBAEH,2FAA2F;gBAC3F,8EAA8E;gBAC9E,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,kBAAkB,CAAC,iCAAiC,CAAC,CAAC,CAAC;gBAC/E,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE,CAAC,kBAAkB,CAAC,4BAA4B,EAAE,GAAG,CAAC,CAAC,CAAC;gBACvF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,kBAAkB,CAAC,4CAA4C,CAAC,CAAC,CAAC;gBAExF,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;oBACjB,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;oBACrC,MAAM,eAAe,GAA2B,EAAE,CAAC;oBAEnD,mCAAmC;oBACnC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;wBACvD,IAAI,KAAK,EAAE,CAAC;4BACV,eAAe,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;wBACzE,CAAC;oBACH,CAAC;oBAED,sEAAsE;oBACtE,8DAA8D;oBAC9D,MAAM,YAAY,GAAG;wBACnB,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;wBACrD,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;qBACtC,CAAC;oBAEF,gEAAgE;oBAChE,oEAAoE;oBACpE,MAAM,QAAQ,GAAG;wBACf,cAAc,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC;wBACnC,OAAO,EAAE,eAAe;wBACxB,IAAI,EAAE,YAAY;wBAClB,gEAAgE;wBAChE,YAAY,EAAE,KAAK,IAAI,EAAE;4BACvB,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;4BACtC,IAAI,CAAC;gCACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;4BAC1B,CAAC;4BAAC,OAAO,KAAc,EAAE,CAAC;gCACxB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,2DAA2D,EAAE;oCAC7E,GAAG,EAAE,KAAK;iCACX,CAAC,CAAC;gCACH,OAAO,IAAI,CAAC;4BACd,CAAC;wBACH,CAAC;qBACF,CAAC;oBAEF,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,QAA2B,CAAC,CAAC,CAAC;gBACrD,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBACtB,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAC5B,CAAC,CAAC,CAAC;YAEH,GAAG,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,EAAE;gBAC1B,4EAA4E;gBAC5E,4EAA4E;gBAC5E,yDAAyD;gBACzD,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,CAAC,CAAC,CAAC;YAEH,yDAAyD;YACzD,qEAAqE;YACrE,4EAA4E;YAC5E,8EAA8E;YAC9E,IAAI,gBAAgB,EAAE,CAAC;gBACrB,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE;oBAC1B,0FAA0F;oBAC1F,yFAAyF;oBACzF,2FAA2F;oBAC3F,yFAAyF;oBACzF,MAAM,YAAY,GAAG,IAAI,mBAAmB,CAC1C,yBAAyB,MAAM,IAAI,GAAG,CAAC,QAAQ,oBAAoB,SAAS,MAAM;wBAChF,QAAQ,GAAG,CAAC,QAAQ,EAAE,IAAI;wBAC1B,IAAI;wBACJ,uBAAuB;wBACvB,+CAA+C;wBAC/C,kDAAkD;wBAClD,mCAAmC;wBACnC,6DAA6D;wBAC7D,IAAI;wBACJ,gBAAgB;wBAChB,qEAAqE;wBACrE,yEAAyE;wBACzE,0DAA0D;wBAC1D,0FAA0F,EAC5F,SAAS,CACV,CAAC;oBACF,wFAAwF;oBACxF,2FAA2F;oBAC3F,yBAAyB;oBACzB,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;oBACnC,GAAG,CAAC,OAAO,EAAE,CAAC;gBAChB,CAAC,EAAE,SAAS,CAAC,CAAC;gBAEd,iFAAiF;gBACjF,6FAA6F;gBAC7F,2FAA2F;gBAC3F,6FAA6F;gBAC7F,yFAAyF;gBACzF,oEAAoE;gBACpE,GAAG,CAAC,UAAU,CAAC,SAAS,EAAE,GAAG,EAAE;oBAC7B,GAAG,CAAC,OAAO,EAAE,CAAC;gBAChB,CAAC,CAAC,CAAC;YACL,CAAC;YAED,gEAAgE;YAChE,EAAE;YACF,wFAAwF;YACxF,2FAA2F;YAC3F,+FAA+F;YAC/F,wFAAwF;YACxF,2FAA2F;YAC3F,6FAA6F;YAC7F,+CAA+C;YAC/C,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAoC,CAAC;YACvF,MAAM,MAAM,GAAG,SAAS,EAAE,EAAE,CAAC;YAC7B,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,OAAO,GAAG,GAAG,EAAE;oBACnB,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC;oBACpE,GAAG,CAAC,OAAO,EAAE,CAAC;gBAChB,CAAC,CAAC;gBACF,2FAA2F;gBAC3F,wFAAwF;gBACxF,yFAAyF;gBACzF,2FAA2F;gBAC3F,2FAA2F;gBAC3F,yBAAyB;gBACzB,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;oBACnB,MAAM,CAAC,GAAG,EAAE,CACV,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,YAAY,CAAC,2BAA2B,EAAE,YAAY,CAAC,CAAC,CACrF,CAAC;oBACF,GAAG,CAAC,OAAO,EAAE,CAAC;gBAChB,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;oBAC1D,WAAW,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBACnE,CAAC;YACH,CAAC;YAED,yFAAyF;YACzF,8FAA8F;YAC9F,+FAA+F;YAC/F,kFAAkF;YAClF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBACnB,IAAI,eAAe;oBAAE,OAAO;gBAC5B,kBAAkB,CAAC,oDAAoD,CAAC,CAAC;YAC3E,CAAC,CAAC,CAAC;YAEH,wBAAwB;YACxB,EAAE;YACF,6FAA6F;YAC7F,+FAA+F;YAC/F,0FAA0F;YAC1F,6FAA6F;YAC7F,uEAAuE;YACvE,EAAE;YACF,6FAA6F;YAC7F,uFAAuF;YACvF,0FAA0F;YAC1F,4EAA4E;YAC5E,IAAI,OAAO;gBAAE,OAAO;YACpB,IAAI,CAAC;gBACH,IAAI,IAAI,EAAE,CAAC;oBACT,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAClB,CAAC;gBACD,GAAG,CAAC,GAAG,EAAE,CAAC;YACZ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC1B,GAAG,CAAC,OAAO,EAAE,CAAC;YAChB,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CACtC,aAAiC;IAEjC,IAAI,YAAY,EAAE,EAAE,CAAC;QACnB,OAAO,IAAI,wBAAwB,CAAC,aAAa,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/core/kubernetes/errors.d.ts

@@ -95,6 +95,15 @@ export declare function isNotFoundError(error: unknown): boolean;
  * ```
  */
 export declare function isConflictError(error: unknown): boolean;
+/**
+ * HTTP status codes that are typically retryable.
+ * These indicate temporary issues that may resolve on retry.
+ *
+ * @internal Exported so the read-error classifier in `../deployment/k8s-helpers.ts` can answer
+ * "is this status transient?" from this one list rather than keeping a second copy that could
+ * drift from it.
+ */
+export declare const RETRYABLE_STATUS_CODES: ReadonlySet<number>;
 /**
  * Check if an error is retryable.
  *