@compforge/harness-toolbox 0.4.8 → 0.5.1

package/README.md

@@ -5,7 +5,7 @@ Client, ClientProvider, DataSource, EnvironmentContext and ClientManager are own
 its lifecycle entrypoints re-export the same common symbols.
 
 Shared infrastructure for diagnostic tools, test runners and business adapters. Use the same
-clients to access Kubernetes, MySQL, Redis, OpenSearch and S3-compatible object storage without depending on a particular
+clients to access HTTP(S), Kubernetes, MySQL, Redis, OpenSearch and S3-compatible object storage without depending on a particular
 command, plugin protocol, test model or verdict.
 
 The package supports Node.js 22+ and Bun. Install with `npm install @compforge/harness-toolbox`.
@@ -16,6 +16,31 @@ claiming snapshot consistency; callers supply cancellation and decide how to per
 Protocol adapters have separate entry points; importing lifecycle or transport contracts does
 not load database or Kubernetes drivers.
 
+## HTTP requests
+
+`HttpClient` borrows the same `Transport` as other protocol clients, keeping the logical Host and
+TLS identity even when the socket goes through a port-forward. Limits include the response body;
+statuses and redirects are returned without retries or redirect following.
+
+```ts
+import { ClientManager } from "@compforge/harness-common";
+import { HttpClient } from "@compforge/harness-toolbox/http";
+import { DirectTransport } from "@compforge/harness-toolbox/transport";
+
+const clients = new ClientManager();
+try {
+  const route = await clients.get({ clientKey: "direct", createClient: () => new DirectTransport() });
+  const http = await clients.create({ createClient: (_clients, signal) => new HttpClient(
+    { endpoint: "https://service.example" }, route,
+    { concurrency: 4, connectTimeoutMs: 5000, requestTimeoutMs: 10000, maxResponseBytes: 1024 * 1024 },
+    { signal },
+  ) });
+  const response = await http.request("/health");
+  console.log(response.status, new TextDecoder().decode(response.body));
+  await http.dispose(); // The shared route remains available until root disposal.
+} finally { await clients.dispose(); }
+```
+
 ## File sources
 
 A FileDataSource is a caller-declared acquisition group. Use `LocalFileDataSource` for local paths
@@ -69,7 +94,7 @@ select `single`, `cluster` or `sentinel`; `endpoints` contains that mode's seed
 configuration additionally provides `sentinelMasterName` and optional Sentinel credentials,
 separate from data-node credentials. Cluster connections require database zero.
 
-Supply ordered TCP transports through `ConnectionSource`. Only mapping or handshake network
+Supply one `Transport`, with ordered TCP paths where needed. Only mapping or handshake network
 failures advance to the next transport; authentication and TLS verification failures stop immediately.
 `connectTimeoutMs` bounds each route (mapping and handshake); it defaults to the command
 `timeoutMs`. `acquireTimeoutMs` bounds all candidates together and defaults to the per-route budget
@@ -194,8 +219,17 @@ The Makefile builds common before typechecking or building toolbox.
 A `ClientProvider` identifies a reusable client and constructs it; `DataSource` adds data-access semantics.
 Accessible environments implement ClientProvider directly without becoming data sources. The `Client` owns initialization
 and idempotent disposal; a `ClientManager` joins concurrent initialization for the same key and
-closes owned clients when the caller finishes. A `ConnectionSource` resolves connection settings
-and available `Transport` paths. Clients execute protocol operations through those paths.
+closes owned clients when the caller finishes. Protocol clients take configuration (or an async resolver)
+and one `Transport`; the transport selects and prepares access paths. `clients.create(factory)` creates
+a fresh client that its caller may close early; transports acquired with `get` stay alive until root disposal.
+
+For shared port-forwarding, register a `ServicePortForwardTransport` once per cluster/namespace, then pass the
+borrowed transport to each protocol client. Closing an OpenSearch client leaves the forward available to the next
+OpenSearch, MySQL, Redis or S3 client; root disposal closes the clients before stopping the forward processes.
+Borrower cancellation only stops that borrower's wait. Exited forwards are recreated on the next acquisition.
+Transport mapping changes the dial address, while protocol clients retain the original Host, TLS and signing identity.
+In 0.5, replace `new Client({ resolve, transports }, options)` with
+`new Client(resolve, transport, options)` (S3 retains its explicit limits argument).
 
 ```ts
 import { ClientManager, clientKey, type DataSource } from "@compforge/harness-toolbox";
@@ -205,10 +239,8 @@ import { DirectTransport } from "@compforge/harness-toolbox/transport";
 const target = { host: "localhost", port: 3306, database: "app", user: "reader", password: "..." };
 const source: DataSource<MysqlClient> = {
   clientKey: clientKey("mysql", target),
-  createClient: (_clients, signal) => new MysqlClient({
-    resolve: async () => target,
-    transports: [new DirectTransport()],
-  }, { signal, connectTimeoutMs: 5_000, queryTimeoutMs: 10_000 }),
+  createClient: (_clients, signal) => new MysqlClient(target, new DirectTransport(),
+    { signal, connectTimeoutMs: 5_000, queryTimeoutMs: 10_000 }),
 };
 const clients = new ClientManager();
 try {
@@ -351,7 +383,7 @@ try {
       maxConnections: 16, maxTargets: 8, maxCandidatePods: 8, signal,
     }),
   });
-  // The same instance belongs in each protocol client's ConnectionSource.transports.
+  // Pass this same transport instance to each protocol client; clients never dispose it.
   const address = await relay.connect({host: 'database.internal', port: 3306});
   // Connect the native protocol client to address; do not dispose relay in a Service.
 } finally {

package/dist/{chunk-1ts7pswj.js → chunk-0d8vs5q8.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-6fnhzhdb.js";
 import {
   PortForwardScope
-} from "./chunk-nftzckdy.js";
+} from "./chunk-mvkxs8d0.js";
 
 // src/kubernetes/service-port-forward.ts
 class ServicePortForwarder {
@@ -17,6 +17,8 @@ class ServicePortForwarder {
   pods;
   #cache = new Map;
   #scope;
+  #handles = new Map;
+  #closed = false;
   constructor(opts, services, pods, starter) {
     this.opts = opts;
     this.services = services;
@@ -31,14 +33,28 @@ class ServicePortForwarder {
     return this.#scope.active;
   }
   forward(endpoint) {
+    if (this.#closed)
+      throw new Error("Port-forward transport is closed");
     this.opts.signal?.throwIfAborted();
     const key = `${endpoint.host}:${endpoint.port}`;
     let pending = this.#cache.get(key);
     if (!pending) {
       pending = this.#forward(endpoint);
       this.#cache.set(key, pending);
+      pending.catch(() => {
+        if (this.#cache.get(key) === pending)
+          this.#cache.delete(key);
+      });
     }
-    return pending;
+    return pending.then((mapped) => {
+      const handle = this.#handles.get(key);
+      if (handle?.isAlive && !handle.isAlive()) {
+        if (this.#cache.get(key) === pending)
+          this.#cache.delete(key);
+        return this.forward(endpoint);
+      }
+      return mapped;
+    });
   }
   async forwardServiceTargets(endpoint) {
     const service = findService(this.services, endpoint, this.opts.namespace);
@@ -75,11 +91,26 @@ class ServicePortForwarder {
     if (!result.value) {
       throw new Error(`为 ${target.kind}/${target.name} 建立 port-forward 失败：${result.reason ?? "unknown error"}`);
     }
+    if (this.#closed || this.opts.signal?.aborted) {
+      result.value.stop();
+      this.opts.signal?.throwIfAborted();
+      throw new Error("Port-forward transport is closed");
+    }
+    this.#handles.set(`${endpoint.host}:${endpoint.port}`, result.value);
     return { host: "127.0.0.1", port: result.value.localPort, servername: endpoint.host };
   }
   stop() {
+    this.#closed = true;
     this.#scope.stop();
     this.#cache.clear();
+    this.#handles.clear();
+  }
+  async dispose() {
+    this.#closed = true;
+    await Promise.allSettled(this.#cache.values());
+    await this.#scope.dispose();
+    this.#cache.clear();
+    this.#handles.clear();
   }
 }
 

package/dist/{chunk-h8fwx0k7.js → chunk-18gcp0ck.js}

@@ -1,34 +1,59 @@
+import {
+  Transport
+} from "./chunk-sb5qzv37.js";
+
 // src/transport/index.ts
-class DirectTransport {
+class DirectTransport extends Transport {
   kind = "tcp";
   name = "direct";
-  async connect(endpoint) {
+  paths() {
+    return [this];
+  }
+  async connect(endpoint, attempt) {
+    this.signal.throwIfAborted();
+    attempt?.signal.throwIfAborted();
     return endpoint;
   }
 }
 
-class PortForwardTransport {
+class PortForwardTransport extends Transport {
   forward;
+  release;
   kind = "tcp";
   name = "port-forward";
-  constructor(forward) {
+  constructor(forward, release, signal) {
+    super([], signal);
     this.forward = forward;
+    this.release = release;
+  }
+  paths() {
+    return [this];
   }
-  connect(endpoint) {
-    return this.forward(endpoint);
+  connect(endpoint, attempt) {
+    this.signal.throwIfAborted();
+    attempt?.signal.throwIfAborted();
+    return this.forward(endpoint, attempt);
+  }
+  async close() {
+    await this.release?.();
   }
 }
 
-class PodPythonTransport {
+class PodPythonTransport extends Transport {
   exec;
   python;
   kind = "python";
   name = "pod-python";
   constructor(exec, python = "python") {
+    super();
     this.exec = exec;
     this.python = python;
   }
+  paths() {
+    return [this];
+  }
   run(script, input, timeoutMs) {
+    this.signal.throwIfAborted();
     return this.exec([this.python, "-c", script], { stdin: JSON.stringify(input), timeoutMs });
   }
 }

package/dist/{chunk-35cjec9z.js → chunk-3b877a0y.js}

@@ -3,10 +3,13 @@ import {
 } from "./chunk-z5pm2emz.js";
 import {
   S3Client
-} from "./chunk-zp1s833x.js";
+} from "./chunk-7m95c7pn.js";
 import {
   DirectTransport
-} from "./chunk-h8fwx0k7.js";
+} from "./chunk-18gcp0ck.js";
+import {
+  Transport
+} from "./chunk-sb5qzv37.js";
 
 // src/s3/datasource.ts
 class S3DataSource {
@@ -25,10 +28,7 @@ class S3DataSource {
     });
   }
   createClient(_clients, signal) {
-    return new S3Client({
-      resolve: async () => this.#target,
-      transports: [this.#transport]
-    }, this.#limits, { signal });
+    return new S3Client(this.#target, this.#transport instanceof Transport ? this.#transport : new Transport([this.#transport]), this.#limits, { signal });
   }
 }
 

package/dist/{chunk-gm4swndx.js → chunk-43mcyrh4.js}

@@ -4,26 +4,7 @@ import {
 } from "./chunk-rkt41za2.js";
 
 // src/connection/acquire.ts
-async function awaitWithSignal(pending, signal, cancel) {
-  if (signal.aborted) {
-    cancel?.();
-    pending.catch(() => {});
-    signal.throwIfAborted();
-  }
-  let abort;
-  const cancelled = new Promise((_, reject) => {
-    abort = () => {
-      cancel?.();
-      reject(signal.reason);
-    };
-    signal.addEventListener("abort", abort, { once: true });
-  });
-  try {
-    return await Promise.race([pending, cancelled]);
-  } finally {
-    signal.removeEventListener("abort", abort);
-  }
-}
+import { raceSignal } from "race-signal";
 async function acquireConnection(routes, options) {
   const budget = options.acquireTimeoutMs ?? options.connectTimeoutMs * routes.length;
   if (!routes.length)
@@ -75,9 +56,14 @@ async function acquireConnection(routes, options) {
           }
           return value;
         });
-        result = await awaitWithSignal(prepared, attemptSignal);
+        options.onPending?.(prepared);
+        result = await raceSignal(prepared, attemptSignal);
       } catch (failure) {
-        await discard();
+        try {
+          await discard();
+        } catch (cleanup) {
+          throw new AggregateError([failure, cleanup], "Connection acquisition and cleanup failed", { cause: failure });
+        }
         signal.throwIfAborted();
         const error = attemptSignal.aborted ? attemptSignal.reason : failure;
         reason = options.retryReason(error);
@@ -93,7 +79,11 @@ async function acquireConnection(routes, options) {
         attemptSignal.throwIfAborted();
         return result.connection;
       } catch (error) {
-        await discard();
+        try {
+          await discard();
+        } catch (cleanup) {
+          throw new AggregateError([error, cleanup], "Connection publication and cleanup failed", { cause: error });
+        }
         throw error;
       }
     }
@@ -103,4 +93,4 @@ async function acquireConnection(routes, options) {
   }
 }
 
-export { awaitWithSignal, acquireConnection };
+export { acquireConnection };

package/dist/chunk-56fev9np.js

@@ -0,0 +1,142 @@
+import {
+  isConnectionNetworkError
+} from "./chunk-18gcp0ck.js";
+import {
+  ConcurrencyPool
+} from "./chunk-v3hxvnrc.js";
+import {
+  httpHandler
+} from "./chunk-c2b2jwm4.js";
+import {
+  TimeoutError,
+  ToolboxError
+} from "./chunk-rkt41za2.js";
+
+// src/http/client.ts
+import { HttpRequest } from "@smithy/core/protocols";
+import { Readable } from "node:stream";
+import { raceSignal } from "race-signal";
+class HttpClient {
+  transport;
+  lifecycle;
+  #controller = new AbortController;
+  signal;
+  #endpoint;
+  #target;
+  #limits;
+  #pool;
+  #operations = new Set;
+  #initialization;
+  #disposal;
+  #handler;
+  constructor(target, transport, limits, lifecycle = {}) {
+    this.transport = transport;
+    this.lifecycle = lifecycle;
+    for (const name of ["concurrency", "connectTimeoutMs", "requestTimeoutMs", "maxResponseBytes"]) {
+      const value = limits[name];
+      if (!Number.isSafeInteger(value) || value < 1 || name.endsWith("Ms") && value > 2147483647) {
+        throw new Error(`${name} must be a positive integer within its supported range`);
+      }
+    }
+    this.#endpoint = new URL(target.endpoint);
+    if (!["http:", "https:"].includes(this.#endpoint.protocol) || this.#endpoint.username || this.#endpoint.password || this.#endpoint.search || this.#endpoint.hash)
+      throw new Error("HTTP endpoint requires HTTP(S), without credentials, query or fragment");
+    this.#target = { ...target };
+    this.#limits = { ...limits };
+    this.#pool = new ConcurrencyPool(limits.concurrency);
+    this.signal = AbortSignal.any([this.#controller.signal, transport.signal, ...lifecycle.signal ? [lifecycle.signal] : []]);
+  }
+  initialize() {
+    this.signal.throwIfAborted();
+    return this.#initialization ??= (async () => {
+      const endpoint = this.#endpoint;
+      const route = await this.transport.acquire({
+        name: "HTTP route",
+        signal: this.signal,
+        connectTimeoutMs: this.#limits.connectTimeoutMs,
+        onRoute: this.lifecycle.onRoute,
+        open: async (path, attempt) => {
+          if (path.kind !== "tcp")
+            throw new Error("HTTP requires a TCP transport");
+          return { connection: await path.connect({
+            host: endpoint.hostname.replace(/^\[|\]$/g, ""),
+            port: Number(endpoint.port || (endpoint.protocol === "https:" ? 443 : 80))
+          }, attempt), transport: path.name };
+        },
+        close: () => {},
+        retryReason: (error) => isConnectionNetworkError(error) ? String(error.code) : undefined
+      });
+      this.signal.throwIfAborted();
+      this.#handler = httpHandler(this.#target, route, this.#limits);
+    })();
+  }
+  request(path, options = {}) {
+    this.signal.throwIfAborted();
+    const url = new URL(path, this.#endpoint);
+    if (url.origin !== this.#endpoint.origin || url.username || url.password || url.hash) {
+      throw new Error("HTTP request must retain the configured origin and contain no credentials or fragment");
+    }
+    const headers = {};
+    for (const [name, value] of Object.entries(options.headers ?? {})) {
+      if (name.toLowerCase() === "host")
+        throw new Error("HTTP Host is owned by the configured endpoint");
+      headers[name.toLowerCase()] = value;
+    }
+    headers.host = url.host;
+    const timeout = new AbortController;
+    const timer = setTimeout(() => timeout.abort(new TimeoutError(`HTTP request timed out after ${this.#limits.requestTimeoutMs}ms`)), this.#limits.requestTimeoutMs);
+    timer.unref();
+    const signal = AbortSignal.any([this.signal, timeout.signal, ...options.signal ? [options.signal] : []]);
+    const pending = this.#pool.run(async () => {
+      await raceSignal(this.initialize(), signal);
+      signal.throwIfAborted();
+      const { response } = await this.#handler.handle(new HttpRequest({
+        protocol: url.protocol,
+        hostname: url.hostname,
+        port: Number(url.port || (url.protocol === "https:" ? 443 : 80)),
+        method: options.method ?? "GET",
+        path: url.pathname + url.search,
+        headers,
+        body: options.body
+      }), { abortSignal: signal });
+      const body = response.body;
+      if (!(body instanceof Readable))
+        throw new ToolboxError("HTTP response has no readable body", { kind: "invalid_response" });
+      const abort = () => body.destroy(new Error("HTTP body read cancelled", { cause: signal.reason }));
+      signal.addEventListener("abort", abort, { once: true });
+      try {
+        signal.throwIfAborted();
+        const chunks = [];
+        let size = 0;
+        for await (const chunk of body) {
+          signal.throwIfAborted();
+          const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+          size += bytes.length;
+          if (size > this.#limits.maxResponseBytes)
+            throw new ToolboxError(`HTTP response exceeded ${this.#limits.maxResponseBytes} bytes`, { kind: "limit_exceeded" });
+          chunks.push(bytes);
+        }
+        return { status: response.statusCode, headers: response.headers, body: Buffer.concat(chunks, size) };
+      } finally {
+        signal.removeEventListener("abort", abort);
+        body.destroy();
+      }
+    }, signal).catch((error) => {
+      signal.throwIfAborted();
+      throw error;
+    }).finally(() => clearTimeout(timer));
+    this.#operations.add(pending);
+    pending.then(() => this.#operations.delete(pending), () => this.#operations.delete(pending));
+    return pending;
+  }
+  dispose() {
+    return this.#disposal ??= (async () => {
+      this.#controller.abort(new Error("HTTP client disposed"));
+      await this.#initialization?.catch(() => {});
+      await Promise.allSettled(this.#operations);
+      this.#handler?.destroy();
+    })();
+  }
+}
+
+export { HttpClient };

package/dist/{chunk-zp1s833x.js → chunk-7m95c7pn.js}

@@ -1,9 +1,12 @@
+import {
+  isConnectionNetworkError
+} from "./chunk-18gcp0ck.js";
 import {
   ConcurrencyPool
 } from "./chunk-v3hxvnrc.js";
 import {
   s3Handler
-} from "./chunk-x4ntb898.js";
+} from "./chunk-z8e1ckkq.js";
 
 // src/s3/client.ts
 import {
@@ -33,7 +36,8 @@ function metadata(value) {
 }
 
 class S3Client {
-  source;
+  configuration;
+  transport;
   limits;
   lifecycle;
   #controller = new AbortController;
@@ -44,8 +48,9 @@ class S3Client {
   #disposal;
   #sdk;
   #http;
-  constructor(source, limits, lifecycle = {}) {
-    this.source = source;
+  constructor(configuration, transport, limits, lifecycle = {}) {
+    this.configuration = configuration;
+    this.transport = transport;
     this.limits = limits;
     this.lifecycle = lifecycle;
     positive(limits.concurrency, "concurrency");
@@ -59,19 +64,28 @@ class S3Client {
     return this.#initialization ??= this.#initialize();
   }
   async#initialize() {
-    const target = await this.source.resolve();
+    const target = await (typeof this.configuration === "function" ? this.configuration() : Promise.resolve(this.configuration));
     this.signal.throwIfAborted();
     const url = new URL(target.endpoint);
     if (!["http:", "https:"].includes(url.protocol) || url.username || url.password || url.search || url.hash) {
       throw new Error("S3 endpoint must be an HTTP(S) URL without embedded credentials, query or fragment");
     }
-    const transport = this.source.transports[0];
-    if (!transport || transport.kind !== "tcp")
-      throw new Error("S3 requires a TCP transport");
-    const route = await transport.connect({
-      host: url.hostname,
-      port: Number(url.port || (url.protocol === "https:" ? 443 : 80)),
-      servername: url.hostname
+    const route = await this.transport.acquire({
+      name: "S3 route",
+      signal: this.signal,
+      connectTimeoutMs: this.limits.connectTimeoutMs,
+      onRoute: this.lifecycle.onRoute,
+      open: async (path, attempt) => {
+        if (path.kind !== "tcp")
+          throw new Error("S3 requires a TCP transport");
+        const connection = await path.connect({
+          host: url.hostname,
+          port: Number(url.port || (url.protocol === "https:" ? 443 : 80))
+        }, attempt);
+        return { connection, transport: path.name };
+      },
+      close: () => {},
+      retryReason: (error) => isConnectionNetworkError(error) ? String(error.code) : undefined
     });
     this.signal.throwIfAborted();
     this.#http = s3Handler(target, route, this.limits);
@@ -85,7 +99,6 @@ class S3Client {
       followRegionRedirects: false,
       responseChecksumValidation: "WHEN_REQUIRED"
     });
-    this.lifecycle.onRoute?.({ transport: transport.name });
   }
   #run(options, operation) {
     this.signal.throwIfAborted();

package/dist/{chunk-f3vq900j.js → chunk-92aacbwh.js}

@@ -2,7 +2,7 @@ import {
   BoundedFileClient,
   fileClientOptions,
   filePaths
-} from "./chunk-ww11q58v.js";
+} from "./chunk-rncagjbc.js";
 import {
   FileError
 } from "./chunk-rkt41za2.js";

package/dist/{chunk-x4ntb898.js → chunk-c2b2jwm4.js}

@@ -1,46 +1,46 @@
-// src/s3/handler.ts
+// src/http/handler.ts
 import { Agent as HttpAgent } from "node:http";
 import { Agent as HttpsAgent } from "node:https";
+import { isIP } from "node:net";
+import { checkServerIdentity } from "node:tls";
 import { NodeHttpHandler } from "@smithy/node-http-handler";
-function s3Handler(target, route, limits) {
+function httpHandler(target, route, limits) {
   const endpoint = new URL(target.endpoint);
-  const mapped = route.host !== endpoint.hostname || route.port !== Number(endpoint.port || (endpoint.protocol === "https:" ? 443 : 80));
-  if (mapped && target.forcePathStyle === false) {
-    throw new Error("S3 mapped transports require path-style addressing to preserve bucket and TLS identity");
-  }
+  const hostname = endpoint.hostname.replace(/^\[|\]$/g, "");
+  const mapped = route.host !== hostname || route.port !== Number(endpoint.port || (endpoint.protocol === "https:" ? 443 : 80));
   const pool = { keepAlive: true, maxSockets: limits.concurrency, maxTotalSockets: limits.concurrency };
   const httpAgent = new HttpAgent(pool);
   const httpsAgent = new HttpsAgent({
     ...pool,
     ca: target.ca,
     rejectUnauthorized: true,
-    ...mapped ? { servername: endpoint.hostname } : {}
+    ...mapped ? {
+      servername: isIP(hostname) ? "" : hostname,
+      checkServerIdentity: (_host, certificate) => checkServerIdentity(hostname, certificate)
+    } : {}
   });
-  const transport = new NodeHttpHandler({
+  const engine = new NodeHttpHandler({
     httpAgent,
     httpsAgent,
     connectionTimeout: limits.connectTimeoutMs,
     requestTimeout: limits.requestTimeoutMs,
     throwOnRequestTimeout: true
   });
-  const handler = {
+  return {
     handle(request, options) {
       if (!mapped)
-        return transport.handle(request, options);
+        return engine.handle(request, options);
       const routed = request.clone();
       routed.hostname = route.host;
       routed.port = route.port;
-      return transport.handle(routed, options);
+      return engine.handle(routed, options);
     },
     destroy() {
-      transport.destroy();
+      engine.destroy();
+      httpAgent.destroy();
+      httpsAgent.destroy();
     }
   };
-  return { handler, destroy: () => {
-    handler.destroy();
-    httpAgent.destroy();
-    httpsAgent.destroy();
-  } };
 }
 
-export { s3Handler };
+export { httpHandler };

package/dist/chunk-ehmx0yhp.js

@@ -0,0 +1,52 @@
+import {
+  ServicePortForwarder
+} from "./chunk-0d8vs5q8.js";
+import {
+  KubectlExecutor
+} from "./chunk-rq5fc007.js";
+import {
+  Transport
+} from "./chunk-sb5qzv37.js";
+
+// src/transport/service-port-forward.ts
+import { raceSignal } from "race-signal";
+class ServicePortForwardTransport extends Transport {
+  options;
+  dependencies;
+  kind = "tcp";
+  name = "port-forward";
+  #initialization;
+  #forwarder;
+  constructor(options, dependencies) {
+    super([], options.signal);
+    this.options = options;
+    this.dependencies = dependencies;
+  }
+  paths() {
+    return [this];
+  }
+  initialize() {
+    this.signal.throwIfAborted();
+    const pending = this.#initialization ??= (async () => {
+      this.#forwarder = await ServicePortForwarder.create(this.dependencies?.executor ?? new KubectlExecutor(this.options), { ...this.options, signal: this.resourceSignal }, this.dependencies?.startForward);
+      this.signal.throwIfAborted();
+    })();
+    return raceSignal(pending, this.signal);
+  }
+  get activeForwards() {
+    return this.#forwarder?.activeForwards ?? [];
+  }
+  async connect(endpoint, attempt) {
+    this.signal.throwIfAborted();
+    const signal = attempt ? AbortSignal.any([this.signal, attempt.signal]) : this.signal;
+    await raceSignal(this.initialize(), signal);
+    const mapped = await raceSignal(this.#forwarder.forward(endpoint), signal);
+    return { host: mapped.host, port: mapped.port };
+  }
+  async close() {
+    await this.#initialization?.catch(() => {});
+    await this.#forwarder?.dispose();
+  }
+}
+
+export { ServicePortForwardTransport };