Keep Cloudflare calls within the rotation run's time limit

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Author: Brooooooklyn

platform/packages/api/src/proxy-token-rotation-cloudflare.ts

@@ -12,6 +12,11 @@ import type { RotationBudget } from './proxy-token-rotation.ts';
 
 const PROXY_TOKEN_BINDING = '__VOID_PROXY_TOKEN';
 const REQUEST_TIMEOUT_MS = 60_000;
+/**
+ * A call needs at least this much of the run's time left. Starting one closer
+ * to the deadline would cut a settings PATCH off with its outcome unknown.
+ */
+const MIN_REQUEST_MS = 5_000;
 const DEFAULT_RETRY_AFTER_SECONDS = 60;
 /** Cloudflare's "script not found" error code. */
 const SCRIPT_NOT_FOUND_CODE = 10007;
@@ -91,7 +96,8 @@ export function createRotationCloudflareClient(
 
   async function request<T>(method: string, path: string, body?: BodyInit): Promise<T> {
     const { budget } = input;
-    if (budget.cfCallsRemaining <= 0 || Date.now() >= budget.deadline) {
+    const remainingMs = budget.deadline - Date.now();
+    if (budget.cfCallsRemaining <= 0 || remainingMs < MIN_REQUEST_MS) {
       throw new RotationBudgetExhaustedError();
     }
     budget.cfCallsRemaining -= 1;
@@ -103,7 +109,7 @@ export function createRotationCloudflareClient(
       method,
       headers,
       body,
-      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+      signal: AbortSignal.timeout(Math.min(REQUEST_TIMEOUT_MS, remainingMs)),
     });
     if (response.status === 429) {
       throw new CloudflareRateLimitError(parseRetryAfter(response.headers.get('Retry-After')));

platform/packages/api/test/unit/proxy-token-rotation-cloudflare.test.ts

@@ -175,4 +175,24 @@ describe('createRotationCloudflareClient', () => {
     expect(fetchMock).not.toHaveBeenCalled();
     expect(runBudget.cfCallsRemaining).toBe(5);
   });
+
+  it('stops before fetch when less than five seconds are left', async () => {
+    const fetchMock = vi.fn<typeof fetch>(async () => cfSuccess(BINDINGS));
+    const runBudget = { cfCallsRemaining: 5, deadline: Date.now() + 4_000 };
+    await expect(client(fetchMock, runBudget).getScriptBindings(SCRIPT)).rejects.toBeInstanceOf(
+      RotationBudgetExhaustedError,
+    );
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  it('times a call out at the run deadline when it comes before the request timeout', async () => {
+    const timeout = vi.spyOn(AbortSignal, 'timeout');
+    const fetchMock = vi.fn<typeof fetch>(async () => cfSuccess(BINDINGS));
+    const runBudget = { cfCallsRemaining: 5, deadline: Date.now() + 20_000 };
+    await client(fetchMock, runBudget).getScriptBindings(SCRIPT);
+    const [ms] = timeout.mock.calls[0] ?? [];
+    expect(ms).toBeGreaterThan(15_000);
+    expect(ms).toBeLessThanOrEqual(20_000);
+    timeout.mockRestore();
+  });
 });