BA-19: total call-duration deadline (deadlineMs) on the http(s) providers

[hamr0]

What & why (bareloop upstream ask BA-19)

BA-18's timeoutMs bounds socket inactivity (req.setTimeout), which resets on any socket activity by design — so a zombie stream that trickles a byte forever (bytes arriving, the response never completing) never trips it. An adopter saw one generate() run 274 minutes and end in ECONNRESET (not a TimeoutError): the reset proves bytes were flowing, so the idle timer never fired. Nothing bounded total call duration.

The fix

Opt-in deadlineMs on all four http(s) providers — an absolute, non-resetting wall-clock ceiling (applyRequestDeadline in the shared src/provider-http.js).

• Disabled by default (a deliberately long single call is legitimate; a default would kill it); 0/Infinity disable; per-call overridable.
• On trip: a terminal TimeoutError distinguishable from the idle trip — code:'EDEADLINE', context.bound:'deadline', retryable:false (a hard ceiling is meant to STOP, not re-spend). The idle trip now also carries context.bound:'idle'.
• With both armed and timeoutMs < deadlineMs, a silent socket trips the idle bound first.

Review fixes folded in

• Finding 1 (correctness): a garbage/non-numeric deadlineMs no longer silently disables the deadline (which would reintroduce the hang) — resolveTimeoutMs throws a ValidationError on an explicitly-set garbage value when the knob has no safe default; the idle bound still fails safe to its 10-min default (BA-18 unchanged).
• Finding 2 (cleanup): idle + deadline wiring collapsed to one applyRequestBounds seam per _request, so a future third bound is added in one place.

Verification

• POC 5/5; +23 tests across all four providers (all four acceptance criteria + review-fix edges).
• Mutations proven RED incl. a deadline-OFF negative control that hangs, and both review-fix mutations.
• Full suite 1042 pass / 0 fail / 2 skip; typecheck + build:types exit 0.

🤖 Generated with Claude Code