@compforge/harness-toolbox 0.5.4 → 0.5.6

package/README.md

@@ -152,23 +152,27 @@ selectorless Services and failed access raise KubernetesError.
 
 The resource path uses client-node kubeconfig authentication/TLS and bounded native JSON reads,
 not kubectl error text. Configure request timeout, concurrency and response bytes with the
-client's ResourceLimits constructor argument. Native exec uses the same root capacity/byte policy
+client's ResourceLimits constructor argument. Exec uses the same root capacity/byte policy
 with a separate slot pool; its per-call timeout defaults to that policy and covers queueing,
 authentication, upgrade and execution. Explicit per-call timeouts support longer commands.
 
-Exec requires `get pods/exec` permission for the WebSocket upgrade (kubectl/SPDY paths may use
-`create pods/exec`). It connects directly to the Pod exec WebSocket endpoint without a preliminary Pod GET or
-kubectl subprocess. Each command owns a stream session; failures are never retried or replayed.
-Kubeconfig controls authentication, TLS and proxy access. stdout/stderr and remote exit status
-remain separate; retained output and individual messages are bounded. Streaming callers may
-set `collectStdout: false` and enforce their own total byte budget. Root disposal cancels active
-and queued sessions. Protocol v4 is accepted for output-only commands; stdin requires v5 to
-close input without losing remaining output/status. Bun does not expose HTTP upgrade rejection
-status, so those failures retain an unknown connection error. Native exec with a kubeconfig
-proxy requires Node: Bun cannot reliably release proxy sockets or preserve TLS name overrides.
-It fails before opening a session on Bun; use Node or explicitly provide an Executor adapter.
-The transport never bypasses the proxy or TLS checks.
-Port-forward still uses kubectl.
+Output-only exec connects directly to the Pod exec WebSocket endpoint without a preliminary
+Pod GET and requires `get pods/exec`. Commands with explicit stdin (including empty input) use
+`kubectl exec -i`, which handles input EOF through SPDY/v5 on older and newer clusters. This
+path requires a compatible kubectl on the Host, Pod read permission and `create pods/exec`
+for SPDY (`get pods/exec` for WebSocket). The channel is selected before execution; failures
+are never retried or replayed by Toolbox. The result's `command` records the actual channel.
+Kubeconfig controls authentication, TLS and proxy access. Both paths share the root exec slot
+pool, deadline, retained-output byte limit and cancellation. stdout/stderr remain separate;
+native exec uses remote status and kubectl uses process exit status, retaining raw CLI stderr
+without guessing structured HTTP error kinds. Streaming callers may set `collectStdout: false`
+and enforce their own total byte budget; individual output chunks remain bounded. Root disposal
+cancels active and queued sessions and waits for the local kubectl process to exit.
+Output-only sessions accept v4/v5. Bun does not expose HTTP upgrade rejection status, so those
+failures retain an unknown connection error. Native exec with a kubeconfig proxy requires Node:
+Bun cannot reliably release proxy sockets or preserve TLS name overrides. This restriction does
+not apply to the kubectl stdin path. Neither path bypasses proxy or TLS checks.
+Port-forward also uses kubectl.
 See [the shared Workload model](../../../docs/workload.md).
 
 ```ts
@@ -433,7 +437,31 @@ identifiers, never keys, values or errors. Logging does not change retention or
 
 ### Network connectivity
 
-`@compforge/harness-toolbox/network` exports `probeConnectivity({host, port, tls?}, execute, {timeoutMs, signal?})`.
+`@compforge/harness-toolbox/network` exports `probeConnectivity(endpoint, execute, {timeoutMs, signal?})`.
+It consumes `Endpoint` from `@compforge/harness-common`; `ConnectivityTarget` is removed.
+
+```typescript
+import type { Endpoint } from "@compforge/harness-common";
+import { endpointFromUrl, validateEndpoint } from "@compforge/harness-toolbox/endpoint";
+
+const endpoint: Endpoint = endpointFromUrl("https://storage.example:9443/object?signature=private");
+// { scheme: "https", host: "storage.example", port: 9443, secure: true }
+validateEndpoint(endpoint); // Pure validation; no DNS or I/O.
+```
+
+The URL projection drops credentials, path, query and fragment, and unbrackets IPv6 hosts.
+HTTP(S), WS(S) and FTP have default ports. The `tls` scheme requires a port and sets `secure: true`.
+Other schemes require an explicit port and leave
+`secure` unspecified; callers supply any encryption requirement from their protocol configuration.
+Errors do not expose the original URL. Keep the full URL separately for resource access.
+
+`secure` replaces `tls` in probe inputs and result targets. HTTPS/WSS/TLS require `secure: true`;
+HTTP/WS reject it. With `secure: true`, this probe supports direct TLS for `https`, `wss`, and
+explicit `tls` schemes. Other schemes, or a missing scheme, throw `ProtocolError` (a `ToolboxError` with `kind: "protocol"`, `code: "Unsupported"`)
+before execution: protocol-negotiated encryption such as MySQL or STARTTLS is not implemented.
+Without an encryption requirement, a successful TCP check does not prove application-protocol
+availability or encryption. TLS remains the name of the observed handshake stage.
+
 The caller supplies an executor in the consumer environment (host, Pod or sandbox),
 which runs Python 3 with the supplied argv and stdin and enforces timeout/cancellation.
 DNS, TCP and optional verified TLS have separate results and timings. Domain names,

package/dist/{chunk-z15gwjvg.js → chunk-2qgkk7n0.js}

@@ -1,6 +1,6 @@
 import {
   KubernetesError
-} from "./chunk-rkt41za2.js";
+} from "./chunk-68zz17hs.js";
 
 // src/kubernetes/compute-quantity.ts
 function object(value) {

package/dist/{chunk-5w85c7cs.js → chunk-361x998p.js}

@@ -1,6 +1,6 @@
 import {
   resourcePath
-} from "./chunk-dpcge1xt.js";
+} from "./chunk-jt8fn3wg.js";
 import {
   clientKey
 } from "./chunk-a9htb6cr.js";
@@ -11,7 +11,7 @@ import {
   KubernetesError,
   ToolboxError,
   kubernetesHttpError
-} from "./chunk-rkt41za2.js";
+} from "./chunk-68zz17hs.js";
 
 // src/kubernetes/resource-transport.ts
 import { KubeConfig } from "@kubernetes/client-node";

package/dist/{chunk-rkt41za2.js → chunk-68zz17hs.js}

@@ -10,6 +10,12 @@ class ToolboxError extends Error {
   }
 }
 
+class ProtocolError extends ToolboxError {
+  constructor(message, options) {
+    super(message, { ...options, kind: "protocol" });
+  }
+}
+
 class KubernetesError extends ToolboxError {
 }
 
@@ -47,4 +53,4 @@ function kubernetesCommandError(result) {
   return status ? kubernetesHttpError(status) : new KubernetesError("Kubernetes resource request failed", { kind: "operation_failed" });
 }
 
-export { ToolboxError, KubernetesError, FileError, TimeoutError, kubernetesHttpError, kubernetesCommandError };
+export { ToolboxError, ProtocolError, KubernetesError, FileError, TimeoutError, kubernetesHttpError, kubernetesCommandError };

package/dist/{chunk-kxpecgy7.js → chunk-6dfcndra.js}

@@ -1,10 +1,10 @@
 import {
   isConnectionNetworkError
-} from "./chunk-18gcp0ck.js";
+} from "./chunk-ps7f1x05.js";
 import {
   TimeoutError,
   ToolboxError
-} from "./chunk-rkt41za2.js";
+} from "./chunk-68zz17hs.js";
 
 // src/opensearch/client.ts
 import { raceSignal } from "race-signal";

package/dist/{chunk-sb5qzv37.js → chunk-6rcyw5ek.js}

@@ -1,6 +1,6 @@
 import {
   acquireConnection
-} from "./chunk-43mcyrh4.js";
+} from "./chunk-9f9dsjnr.js";
 
 // src/transport/lifecycle.ts
 class Transport {

package/dist/{chunk-56fev9np.js → chunk-81agmerq.js}

@@ -1,6 +1,6 @@
 import {
   isConnectionNetworkError
-} from "./chunk-18gcp0ck.js";
+} from "./chunk-ps7f1x05.js";
 import {
   ConcurrencyPool
 } from "./chunk-v3hxvnrc.js";
@@ -10,7 +10,7 @@ import {
 import {
   TimeoutError,
   ToolboxError
-} from "./chunk-rkt41za2.js";
+} from "./chunk-68zz17hs.js";
 
 // src/http/client.ts
 import { HttpRequest } from "@smithy/core/protocols";

package/dist/{chunk-0d8vs5q8.js → chunk-91xh8tsr.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-6fnhzhdb.js";
 import {
   PortForwardScope
-} from "./chunk-mvkxs8d0.js";
+} from "./chunk-v9rcxg0e.js";
 
 // src/kubernetes/service-port-forward.ts
 class ServicePortForwarder {

package/dist/{chunk-43mcyrh4.js → chunk-9f9dsjnr.js}

@@ -1,7 +1,7 @@
 import {
   TimeoutError,
   ToolboxError
-} from "./chunk-rkt41za2.js";
+} from "./chunk-68zz17hs.js";
 
 // src/connection/acquire.ts
 import { raceSignal } from "race-signal";

package/dist/{chunk-ex429qjt.js → chunk-bkz0dyx5.js}

@@ -12,16 +12,16 @@ import {
 } from "./chunk-835fssgz.js";
 import {
   isConnectionNetworkError
-} from "./chunk-18gcp0ck.js";
+} from "./chunk-ps7f1x05.js";
 import {
   ConcurrencyPool
 } from "./chunk-v3hxvnrc.js";
 import {
   Transport
-} from "./chunk-sb5qzv37.js";
+} from "./chunk-6rcyw5ek.js";
 import {
   ToolboxError
-} from "./chunk-rkt41za2.js";
+} from "./chunk-68zz17hs.js";
 
 // src/mysql/client.ts
 import { raceSignal } from "race-signal";

package/dist/{chunk-ae84rzq5.js → chunk-d2y5ewbb.js}

@@ -1,6 +1,6 @@
 import {
   KubernetesError
-} from "./chunk-rkt41za2.js";
+} from "./chunk-68zz17hs.js";
 
 // src/kubernetes/workload.ts
 function failure(message, kind) {

package/dist/{chunk-xeft7af0.js → chunk-dfpqr0r9.js}

@@ -1,38 +1,41 @@
 import {
   ConcurrencyPool
 } from "./chunk-v3hxvnrc.js";
+import {
+  KubectlExecutor,
+  buildExecArgs
+} from "./chunk-evb5tj13.js";
 import {
   KubernetesError,
   kubernetesHttpError
-} from "./chunk-rkt41za2.js";
+} from "./chunk-68zz17hs.js";
 
 // src/kubernetes/exec-transport.ts
 import { KubeConfig } from "@kubernetes/client-node";
 import WebSocket from "ws";
 class KubernetesExecTransport {
+  connection;
   signal;
   limits;
   #config = new KubeConfig;
   #capacity;
   #server;
-  constructor(options, signal, limits) {
+  constructor(connection, signal, limits) {
+    this.connection = connection;
     this.signal = signal;
     this.limits = limits;
     if (!Object.values(limits).every((value) => Number.isSafeInteger(value) && value > 0)) {
       throw new KubernetesError("Exec limits must be positive integers", { kind: "invalid_argument" });
     }
-    if (options.kubeconfig)
-      this.#config.loadFromFile(options.kubeconfig);
+    if (connection.kubeconfig)
+      this.#config.loadFromFile(connection.kubeconfig);
     else
       this.#config.loadFromDefault();
-    if (options.context)
-      this.#config.setCurrentContext(options.context);
+    if (connection.context)
+      this.#config.setCurrentContext(connection.context);
     const cluster = this.#config.getCurrentCluster();
     if (!cluster)
       throw new KubernetesError("Kubernetes context has no cluster", { kind: "invalid_argument" });
-    if (process.versions.bun && cluster.proxyUrl) {
-      throw new KubernetesError("Native exec through a kubeconfig proxy requires a Node host", { kind: "unsupported_operation" });
-    }
     this.#server = cluster.server.replace(/\/$/, "");
     if (new URL(cluster.server).protocol === "http:")
       this.#config.clusters = this.#config.clusters.map((item) => item === cluster ? { ...item, skipTLSVerify: true } : item);
@@ -49,17 +52,71 @@ class KubernetesExecTransport {
     const signal = AbortSignal.any([caller, deadline.signal]);
     const timer = setTimeout(() => deadline.abort(), timeoutMs);
     try {
-      return await this.#capacity.run(() => this.#session(namespace, target, command, options, signal, started, deadline.signal), signal);
+      return await this.#capacity.run(() => options.stdin === undefined ? this.#session(namespace, target, command, options, signal, started, deadline.signal) : this.#stdinSession(namespace, target, command, options, signal, started), signal);
     } catch (error) {
       if (caller.aborted)
         throw caller.reason;
-      if (deadline.signal.aborted)
-        return this.#result(namespace, target, command, started, null, "", "Exec deadline exceeded", true);
+      if (deadline.signal.aborted) {
+        const result = this.#result(namespace, target, command, started, null, "", "Exec deadline exceeded", true);
+        if (options.stdin !== undefined)
+          result.command = buildExecArgs({ ...this.connection, namespace }, target, command, true);
+        return result;
+      }
       throw error;
     } finally {
       clearTimeout(timer);
     }
   }
+  async#stdinSession(namespace, target, command, options, signal, started) {
+    const controller = new AbortController;
+    const combined = AbortSignal.any([signal, controller.signal]);
+    let retained = 0;
+    let stdout = "";
+    let failure;
+    const guard = (action) => {
+      if (combined.aborted)
+        return;
+      try {
+        action();
+      } catch (cause) {
+        failure = cause;
+        controller.abort(cause);
+        throw cause;
+      }
+    };
+    const count = (size, retain) => {
+      if (retain)
+        retained += size;
+      if (size > this.limits.maxBytes || retained > this.limits.maxBytes) {
+        throw new KubernetesError(`Kubernetes exec ${namespace}/${target.pod} output exceeds ${this.limits.maxBytes} bytes`, { kind: "limit_exceeded" });
+      }
+    };
+    const executor = new KubectlExecutor({ ...this.connection, namespace });
+    const result = await executor.exec(target, command, {
+      ...options,
+      signal: combined,
+      timeoutMs: Math.max(1, (options.timeoutMs ?? this.limits.timeoutMs) - (performance.now() - started)),
+      collectStdout: false,
+      onStdoutBytes: (bytes) => guard(() => {
+        count(bytes.length, options.collectStdout !== false);
+        options.onStdoutBytes?.(bytes);
+      }),
+      onStdout: (text) => guard(() => {
+        if (options.collectStdout !== false)
+          stdout += text;
+        options.onStdout?.(text);
+      }),
+      onStderr: (text) => guard(() => {
+        count(Buffer.byteLength(text), true);
+        options.onStderr?.(text);
+      })
+    });
+    if (controller.signal.aborted)
+      throw failure;
+    if (signal.aborted)
+      throw signal.reason;
+    return { ...result, stdout, durationMs: performance.now() - started };
+  }
   #result(namespace, target, command, started, exitCode, stdout, stderr, timedOut = false) {
     return {
       ok: exitCode === 0 && !timedOut,
@@ -81,10 +138,12 @@ class KubernetesExecTransport {
     };
   }
   #session(namespace, target, command, options, signal, started, deadline) {
+    if (process.versions.bun && this.#config.getCurrentCluster()?.proxyUrl) {
+      throw new KubernetesError("Native exec through a kubeconfig proxy requires a Node host", { kind: "unsupported_operation" });
+    }
     return new Promise((resolve, reject) => {
       let socket;
       let agent;
-      let input;
       let settled = false;
       let stdout = "", stderr = "", retained = 0;
       const outDecoder = new TextDecoder, errDecoder = new TextDecoder;
@@ -95,7 +154,6 @@ class KubernetesExecTransport {
         signal.removeEventListener("abort", abort);
         socket?.terminate();
         agent?.destroy();
-        input?.cancel().catch(() => {});
         const tail = outDecoder.decode(), errTail = errDecoder.decode();
         if (options.collectStdout !== false)
           stdout += tail;
@@ -140,11 +198,11 @@ Exec deadline exceeded`;
           url.searchParams.append("command", arg);
         url.searchParams.set("stdout", "true");
         url.searchParams.set("stderr", "true");
-        url.searchParams.set("stdin", String(options.stdin !== undefined));
+        url.searchParams.set("stdin", "false");
         url.searchParams.set("tty", "false");
         if (target.container)
           url.searchParams.set("container", target.container);
-        socket = new WebSocket(url, options.stdin === undefined ? ["v5.channel.k8s.io", "v4.channel.k8s.io"] : ["v5.channel.k8s.io"], { ...request, ...process.versions.bun ? { tls: {
+        socket = new WebSocket(url, ["v5.channel.k8s.io", "v4.channel.k8s.io"], { ...request, ...process.versions.bun ? { tls: {
           ca: request.ca,
           cert: request.cert,
           key: request.key,
@@ -225,37 +283,6 @@ Exec deadline exceeded`;
             fail("invalid_response", error);
           }
         });
-        socket.on("open", () => {
-          if (options.stdin === undefined || settled)
-            return;
-          const send = (bytes) => new Promise((done, failed) => {
-            if (settled) {
-              failed(new Error("Exec closed"));
-              return;
-            }
-            socket.send(Buffer.concat([Buffer.from([0]), bytes]), (error) => error ? failed(error) : done());
-          });
-          (async () => {
-            const stdin = options.stdin;
-            if (typeof stdin === "string" || stdin instanceof Uint8Array)
-              await send(typeof stdin === "string" ? new TextEncoder().encode(stdin) : stdin);
-            else {
-              const reader = stdin.getReader();
-              input = reader;
-              while (!settled) {
-                const chunk = await reader.read();
-                if (chunk.done)
-                  break;
-                await send(chunk.value);
-              }
-            }
-            if (!settled)
-              socket.send(Buffer.from([255, 0]));
-          })().catch((error) => {
-            if (!settled)
-              fail("connection_failed", error);
-          });
-        });
       }).catch((error) => {
         if (!settled)
           fail("connection_failed", error);

package/dist/{chunk-hbhbragw.js → chunk-erbehkcz.js}

@@ -1,21 +1,21 @@
+import {
+  resolveWorkload
+} from "./chunk-d2y5ewbb.js";
 import {
   KubernetesResourceTransport
-} from "./chunk-5w85c7cs.js";
+} from "./chunk-361x998p.js";
 import {
   KubernetesExecTransport
-} from "./chunk-xeft7af0.js";
-import {
-  resolveWorkload
-} from "./chunk-ae84rzq5.js";
+} from "./chunk-dfpqr0r9.js";
 import {
   ServicePortForwarder
-} from "./chunk-0d8vs5q8.js";
+} from "./chunk-91xh8tsr.js";
 import {
   KubectlExecutor
-} from "./chunk-rq5fc007.js";
+} from "./chunk-evb5tj13.js";
 import {
   KubernetesError
-} from "./chunk-rkt41za2.js";
+} from "./chunk-68zz17hs.js";
 
 // src/kubernetes/client.ts
 class KubernetesClient {

package/dist/{chunk-rq5fc007.js → chunk-evb5tj13.js}

@@ -68,24 +68,25 @@ async function runArgv(argv, opts) {
   let aborted = false;
   const abort = () => {
     aborted = true;
-    proc.kill();
+    proc.kill("SIGKILL");
   };
   const timer = setTimeout(() => {
     timedOut = true;
-    proc.kill();
+    proc.kill("SIGKILL");
   }, timeoutMs);
   if (opts?.signal?.aborted)
     abort();
   else
     opts?.signal?.addEventListener("abort", abort, { once: true });
+  const outputs = [
+    readOutput(proc.stdout, opts?.onStdout, opts?.onStdoutBytes, opts?.collectStdout ?? true),
+    readOutput(proc.stderr, opts?.onStderr),
+    proc.exited
+  ];
   try {
-    const [stdout, stderr, exitCode] = await Promise.all([
-      readOutput(proc.stdout, opts?.onStdout, opts?.onStdoutBytes, opts?.collectStdout ?? true),
-      readOutput(proc.stderr, opts?.onStderr),
-      proc.exited
-    ]);
+    const [stdout, stderr, exitCode] = await Promise.all(outputs);
     return {
-      ok: exitCode === 0 && !timedOut,
+      ok: exitCode === 0 && !timedOut && !aborted,
       exitCode,
       stdout,
       stderr: timedOut ? `${stderr}
@@ -96,6 +97,8 @@ async function runArgv(argv, opts) {
       command: argv
     };
   } catch (err) {
+    proc.kill("SIGKILL");
+    await Promise.allSettled(outputs);
     return {
       ok: false,
       exitCode: null,

package/dist/{chunk-3b877a0y.js → chunk-hj14hfvz.js}

@@ -3,13 +3,13 @@ import {
 } from "./chunk-z5pm2emz.js";
 import {
   S3Client
-} from "./chunk-7m95c7pn.js";
+} from "./chunk-mj6ckk1g.js";
 import {
   DirectTransport
-} from "./chunk-18gcp0ck.js";
+} from "./chunk-ps7f1x05.js";
 import {
   Transport
-} from "./chunk-sb5qzv37.js";
+} from "./chunk-6rcyw5ek.js";
 
 // src/s3/datasource.ts
 class S3DataSource {

package/dist/{chunk-dpcge1xt.js → chunk-jt8fn3wg.js}

@@ -1,6 +1,6 @@
 import {
   KubernetesError
-} from "./chunk-rkt41za2.js";
+} from "./chunk-68zz17hs.js";
 
 // src/kubernetes/resources.ts
 function resourcePath(query, name) {

package/dist/{chunk-7m95c7pn.js → chunk-mj6ckk1g.js}

@@ -1,6 +1,6 @@
 import {
   isConnectionNetworkError
-} from "./chunk-18gcp0ck.js";
+} from "./chunk-ps7f1x05.js";
 import {
   ConcurrencyPool
 } from "./chunk-v3hxvnrc.js";

package/dist/{chunk-92aacbwh.js → chunk-nhr4za0z.js}

@@ -2,10 +2,10 @@ import {
   BoundedFileClient,
   fileClientOptions,
   filePaths
-} from "./chunk-rncagjbc.js";
+} from "./chunk-rybhzd2y.js";
 import {
   FileError
-} from "./chunk-rkt41za2.js";
+} from "./chunk-68zz17hs.js";
 
 // src/file/local.ts
 import { constants } from "node:fs";

package/dist/chunk-nr6ams69.js

@@ -0,0 +1,50 @@
+// src/network/endpoint.ts
+import { isIP } from "node:net";
+var URL_DEFAULTS = new Map([
+  ["http", { port: 80, secure: false }],
+  ["https", { port: 443, secure: true }],
+  ["ws", { port: 80, secure: false }],
+  ["wss", { port: 443, secure: true }],
+  ["ftp", { port: 21, secure: false }],
+  ["tls", { secure: true }]
+]);
+function validateEndpoint(endpoint) {
+  if (typeof endpoint.host !== "string" || !endpoint.host || /[\s/\\?#@%\[\]]/.test(endpoint.host) || endpoint.host.includes(":") && isIP(endpoint.host) !== 6) {
+    throw new Error("Endpoint host must be a hostname/IP, with IPv6 unbracketed and no URL components");
+  }
+  if (!Number.isInteger(endpoint.port) || endpoint.port < 1 || endpoint.port > 65535) {
+    throw new Error("Endpoint port must be an integer between 1 and 65535");
+  }
+  if (endpoint.scheme !== undefined && !/^[a-z][a-z0-9+.-]*$/.test(endpoint.scheme)) {
+    throw new Error("Endpoint scheme must be lowercase and contain no colon");
+  }
+  if (endpoint.secure !== undefined && typeof endpoint.secure !== "boolean")
+    throw new Error("Endpoint secure must be boolean");
+  const defaults = endpoint.scheme ? URL_DEFAULTS.get(endpoint.scheme) : undefined;
+  if (defaults && endpoint.scheme !== "ftp" && (endpoint.secure ?? false) !== defaults.secure) {
+    throw new Error("Endpoint secure conflicts with its scheme; HTTPS/WSS/TLS require encryption");
+  }
+}
+function endpointFromUrl(value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new Error("Endpoint requires a valid absolute network URL");
+  }
+  const scheme = url.protocol.slice(0, -1);
+  const defaults = URL_DEFAULTS.get(scheme);
+  const port = url.port ? Number(url.port) : defaults?.port;
+  if (port === undefined)
+    throw new Error("Endpoint URL requires an explicit port for this scheme");
+  const endpoint = {
+    scheme,
+    host: url.hostname.replace(/^\[|\]$/g, ""),
+    port,
+    ...defaults ? { secure: defaults.secure } : {}
+  };
+  validateEndpoint(endpoint);
+  return endpoint;
+}
+
+export { validateEndpoint, endpointFromUrl };

package/dist/{chunk-18gcp0ck.js → chunk-ps7f1x05.js}

@@ -1,6 +1,6 @@
 import {
   Transport
-} from "./chunk-sb5qzv37.js";
+} from "./chunk-6rcyw5ek.js";
 
 // src/transport/index.ts
 class DirectTransport extends Transport {

package/dist/{chunk-rncagjbc.js → chunk-rybhzd2y.js}

@@ -4,7 +4,7 @@ import {
 import {
   FileError,
   ToolboxError
-} from "./chunk-rkt41za2.js";
+} from "./chunk-68zz17hs.js";
 
 // src/file/client.ts
 function fileClientOptions(options) {

package/dist/{chunk-kap6ka3n.js → chunk-s7a3fqzc.js}

@@ -3,13 +3,13 @@ import {
 } from "./chunk-ssj93brx.js";
 import {
   startPortForward
-} from "./chunk-mvkxs8d0.js";
+} from "./chunk-v9rcxg0e.js";
 import {
   KubectlExecutor
-} from "./chunk-rq5fc007.js";
+} from "./chunk-evb5tj13.js";
 import {
   Transport
-} from "./chunk-sb5qzv37.js";
+} from "./chunk-6rcyw5ek.js";
 
 // src/transport/pod-relay.ts
 import { raceSignal } from "race-signal";

package/dist/{chunk-mvkxs8d0.js → chunk-v9rcxg0e.js}

@@ -1,6 +1,6 @@
 import {
   buildKubectlArgs
-} from "./chunk-rq5fc007.js";
+} from "./chunk-evb5tj13.js";
 import {
   spawnProcess
 } from "./chunk-9shz0bw1.js";

package/dist/{chunk-xhfbark7.js → chunk-wnykdxz8.js}

@@ -2,10 +2,10 @@ import {
   BoundedFileClient,
   fileClientOptions,
   filePaths
-} from "./chunk-rncagjbc.js";
+} from "./chunk-rybhzd2y.js";
 import {
   FileError
-} from "./chunk-rkt41za2.js";
+} from "./chunk-68zz17hs.js";
 
 // src/file/pod.ts
 import { posix } from "node:path";