@lakutata/webrtc 0.0.0-stage → 3.1.4

package/dist/esm/signaling/SignalingController.js

@@ -0,0 +1,225 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { DTO } from '@lakutata/core';
+import { Expect } from '@lakutata/core/decorator/dto';
+import { Controller } from '@lakutata/entrypoint';
+import { ServiceAction } from '@lakutata/entrypoint/decorator/ctrl';
+import { SignalingMethod } from '../protocol/SignalingProtocol.js';
+import { SignalingClientRequiredException } from '../exceptions/SignalingClientRequiredException.js';
+/**
+ * The input of `webrtc.join`
+ */
+class JoinDTO extends DTO {
+}
+__decorate([
+    Expect(DTO.String().min(1).max(256).required()),
+    __metadata("design:type", String)
+], JoinDTO.prototype, "room", void 0);
+__decorate([
+    Expect(DTO.Any().optional()),
+    __metadata("design:type", Object)
+], JoinDTO.prototype, "metadata", void 0);
+__decorate([
+    Expect(DTO.String().max(128).optional()),
+    __metadata("design:type", String)
+], JoinDTO.prototype, "session", void 0);
+/**
+ * The input of `webrtc.leave`
+ */
+class LeaveDTO extends DTO {
+}
+__decorate([
+    Expect(DTO.String().min(1).max(256).required()),
+    __metadata("design:type", String)
+], LeaveDTO.prototype, "room", void 0);
+/**
+ * The input of `webrtc.signal`: a description or a candidate (null or an empty candidate for the end of the candidates)
+ */
+class SignalDTO extends DTO {
+}
+__decorate([
+    Expect(DTO.String().min(1).max(256).required()),
+    __metadata("design:type", String)
+], SignalDTO.prototype, "room", void 0);
+__decorate([
+    Expect(DTO.String().min(1).max(256).required()),
+    __metadata("design:type", String)
+], SignalDTO.prototype, "to", void 0);
+__decorate([
+    Expect(DTO.Object({
+        type: DTO.String().valid('offer', 'answer', 'pranswer', 'rollback').required(),
+        sdp: DTO.String().allow('').optional()
+    }).optional()),
+    __metadata("design:type", Object)
+], SignalDTO.prototype, "description", void 0);
+__decorate([
+    Expect(DTO.Object({
+        candidate: DTO.String().allow('').required(),
+        sdpMid: DTO.String().allow('', null).optional(),
+        sdpMLineIndex: DTO.Number().integer().min(0).allow(null).optional(),
+        usernameFragment: DTO.String().allow('', null).optional()
+    }).allow(null).optional()),
+    __metadata("design:type", Object)
+], SignalDTO.prototype, "candidate", void 0);
+/**
+ * The controller serving the requests of the signaling ({@link Signaling}), registered as `signaling`): `webrtc.join`,
+ * `webrtc.signal`, `webrtc.leave`, `webrtc.iceServers` and `webrtc.heartbeat`. Their pattern is `{method}`: the method
+ * of a JSON-RPC request, the `method` field of a Socket.IO message (`{method: 'webrtc.join', room: 'meeting'}`). The
+ * member of a request is its client (`clientId` of the context). The events are pushed to the clients, so the requests
+ * coming without a connection to push them through (JSON-RPC over HTTP, the HTTP service adapter) fail with
+ * {@link SignalingClientRequiredException}.
+ *
+ * Add it to the controllers of an entrypoint serving Socket.IO or JSON-RPC over WebSocket; the browser client of
+ * `@lakutata/webrtc/client` and the `SignalingClient` of Node.js speak this protocol.
+ * @example
+ * ```typescript
+ * import {Application} from 'lakutata'
+ * import {buildEntrypoints} from 'lakutata/com/entrypoint'
+ * import {jsonRPCServiceEntrypoint} from 'lakutata/adapter/jsonrpc'
+ * import {socketIOServiceEntrypoint} from 'lakutata/adapter/socket.io'
+ * import {buildSignalingOptions, SignalingController} from '@lakutata/webrtc'
+ *
+ * Application.run(() => ({
+ *     id: 'meet.app',
+ *     name: 'Meet',
+ *     components: {
+ *         signaling: buildSignalingOptions(),
+ *         //The browsers over Socket.IO on 3000, the other clients over JSON-RPC (WebSocket) on 3001
+ *         entrypoint: buildEntrypoints({
+ *             controllers: [SignalingController],
+ *             service: [socketIOServiceEntrypoint({port: 3000}), jsonRPCServiceEntrypoint({transport: 'websocket', port: 3001})]
+ *         })
+ *     },
+ *     bootstrap: ['entrypoint']
+ * }))
+ * ```
+ */
+export class SignalingController extends Controller {
+    /**
+     * The signaling component: the one registered as `signaling`.
+     * @protected
+     */
+    async signaling() {
+        return await this.getObject('signaling');
+    }
+    /**
+     * The member of the request: its client id
+     * @protected
+     */
+    peerId() {
+        const context = this.context;
+        //JSON-RPC over HTTP gives a client id (the id header) but has no connection to push the events through; a data
+        //channel of webrtcServiceEntrypoint is set up by the signaling itself (a member joining through it as itself
+        //would replace its own session)
+        if (!context.clientId || context.jsonrpc?.transport === 'http' || context.jsonrpc?.transport === 'webrtc') {
+            throw new SignalingClientRequiredException('The signaling needs a transport with clients (Socket.IO, JSON-RPC over WebSocket)');
+        }
+        return context.clientId;
+    }
+    /**
+     * `webrtc.join`: join a room.
+     * @param input The room, and the metadata the other members get.
+     * @returns The members already in the room, the ICE servers and the heartbeat interval.
+     * @example
+     * ```typescript
+     * //Socket.IO: socket.emit('message', {method: 'webrtc.join', room: 'meeting', metadata: {name: 'Ada'}}, ack)
+     * //JSON-RPC: {"jsonrpc": "2.0", "id": 1, "method": "webrtc.join", "params": {"room": "meeting"}}
+     * ```
+     */
+    async join(input) {
+        return await (await this.signaling()).join(this.peerId(), input.room, { metadata: input.metadata, session: input.session, context: this.context });
+    }
+    /**
+     * `webrtc.signal`: send a description or a candidate to a member of a room.
+     * @param input The room, the receiver, the description or the candidate.
+     * @returns Whether the event reached the receiver.
+     * @example
+     * ```typescript
+     * //{method: 'webrtc.signal', room: 'meeting', to: 'bob', description: {type: 'offer', sdp: '…'}}
+     * //{method: 'webrtc.signal', room: 'meeting', to: 'bob', candidate: {candidate: 'candidate:…', sdpMid: '0'}}
+     * ```
+     */
+    async sendSignal(input) {
+        const delivered = await (await this.signaling()).signal(this.peerId(), input.room, input.to, {
+            description: input.description,
+            candidate: input.candidate
+        });
+        return { delivered: delivered };
+    }
+    /**
+     * `webrtc.leave`: leave a room.
+     * @param input The room.
+     * @returns Nothing.
+     * @example
+     * ```typescript
+     * //{method: 'webrtc.leave', room: 'meeting'}
+     * ```
+     */
+    async leave(input) {
+        await (await this.signaling()).leave(this.peerId(), input.room);
+        return {};
+    }
+    /**
+     * `webrtc.iceServers`: get the ICE servers again, with new TURN credentials (before the ones given expire).
+     * @returns The ICE servers, and how long their credentials are valid in seconds.
+     * @example
+     * ```typescript
+     * //{method: 'webrtc.iceServers'}
+     * ```
+     */
+    async iceServers() {
+        const signaling = await this.signaling();
+        const peerId = this.peerId();
+        signaling.heartbeat(peerId);
+        return await signaling.iceServersOf(peerId);
+    }
+    /**
+     * `webrtc.heartbeat`: tell the server the client is still there.
+     * @returns Nothing.
+     * @example
+     * ```typescript
+     * //{method: 'webrtc.heartbeat'}, every heartbeatInterval milliseconds of the join result when it is not 0
+     * ```
+     */
+    async heartbeat() {
+        (await this.signaling()).heartbeat(this.peerId());
+        return {};
+    }
+}
+__decorate([
+    ServiceAction({ method: SignalingMethod.join }, JoinDTO),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [JoinDTO]),
+    __metadata("design:returntype", Promise)
+], SignalingController.prototype, "join", null);
+__decorate([
+    ServiceAction({ method: SignalingMethod.signal }, SignalDTO),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [SignalDTO]),
+    __metadata("design:returntype", Promise)
+], SignalingController.prototype, "sendSignal", null);
+__decorate([
+    ServiceAction({ method: SignalingMethod.leave }, LeaveDTO),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [LeaveDTO]),
+    __metadata("design:returntype", Promise)
+], SignalingController.prototype, "leave", null);
+__decorate([
+    ServiceAction({ method: SignalingMethod.iceServers }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], SignalingController.prototype, "iceServers", null);
+__decorate([
+    ServiceAction({ method: SignalingMethod.heartbeat }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], SignalingController.prototype, "heartbeat", null);

package/dist/esm/turn/TURNCredentials.js

@@ -0,0 +1,44 @@
+import { createHmac } from 'node:crypto';
+/**
+ * Create short-lived TURN credentials.
+ * @param secret The secret shared with the TURN server.
+ * @param user The user the credentials are for (the part of the username after the expiry); it may not hold `:`.
+ * @param ttl How long they are valid, in seconds.
+ * @param now The current time in milliseconds (for tests).
+ * @returns The credentials.
+ * @example
+ * ```typescript
+ * import {createTURNCredentials, type TURNCredentials} from '@lakutata/webrtc'
+ *
+ * //Valid for an hour, for the user alice: {username: '1767229200:alice', credential: '…', ttl: 3600}
+ * const credentials: TURNCredentials = createTURNCredentials('the shared secret', 'alice', 3600)
+ * ```
+ */
+export function createTURNCredentials(secret, user, ttl, now = Date.now()) {
+    const username = `${Math.floor(now / 1000) + Math.floor(ttl)}:${user.replaceAll(':', '_')}`;
+    return { username: username, credential: turnPassword(secret, username), ttl: Math.floor(ttl) };
+}
+/**
+ * The password of a username of short-lived credentials
+ * @param secret
+ * @param username
+ */
+export function turnPassword(secret, username) {
+    return createHmac('sha1', secret).update(username).digest('base64');
+}
+/**
+ * The password of a username when its credentials are short-lived ones of the secret and not expired; undefined
+ * otherwise (for the TURN server: an unknown user)
+ * @param secret
+ * @param username
+ * @param now
+ */
+export function turnPasswordIfValid(secret, username, now = Date.now()) {
+    const separator = username.indexOf(':');
+    if (separator <= 0)
+        return undefined;
+    const expiry = Number(username.slice(0, separator));
+    if (!Number.isFinite(expiry) || expiry * 1000 < now)
+        return undefined;
+    return turnPassword(secret, username);
+}

package/dist/esm/turn/TURNIceServers.js

@@ -0,0 +1,22 @@
+/**
+ * The ICE servers of a TURN server, as `RTCIceServer` objects: STUN, then TURN over UDP and TCP, then over TLS
+ * @param location Where the clients reach it.
+ * @param credentials The username and the password.
+ */
+export function iceServersOfTURN(location, credentials) {
+    const { address, port, udp, tcp, tlsPort } = location;
+    const host = address.includes(':') ? `[${address}]` : address;
+    const urls = [];
+    if (udp)
+        urls.push(`turn:${host}:${port}?transport=udp`);
+    if (tcp)
+        urls.push(`turn:${host}:${port}?transport=tcp`);
+    if (tlsPort !== undefined)
+        urls.push(`turns:${host}:${tlsPort}?transport=tcp`);
+    const servers = [];
+    if (udp)
+        servers.push({ urls: `stun:${host}:${port}` });
+    if (urls.length)
+        servers.push({ urls: urls, username: credentials.username, credential: credentials.credential });
+    return servers;
+}

package/dist/esm/turn/TURNServer.js

@@ -0,0 +1,327 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { randomBytes } from 'node:crypto';
+import { networkInterfaces } from 'node:os';
+import { Component, DTO, InvalidValueException } from '@lakutata/core';
+import { Configurable, Singleton } from '@lakutata/core/decorator/di';
+import { NodeTurnServer } from '../lib/turn/node/turnServer.js';
+import { debug } from '../lib/common/log.js';
+import { createTURNCredentials, turnPasswordIfValid } from './TURNCredentials.js';
+import { iceServersOfTURN } from './TURNIceServers.js';
+import { portsShareable, TURNWorkers, turnWorkers } from './TURNWorkers.js';
+const log = debug('webrtc/turn');
+/**
+ * How often a server in a cluster tells its load, in milliseconds
+ */
+const ANNOUNCE_INTERVAL = 1000;
+//The first IPv4 address of the host that is not internal
+function defaultPublicAddress() {
+    for (const addresses of Object.values(networkInterfaces())) {
+        const address = addresses?.find((info) => info.family === 'IPv4' && !info.internal);
+        if (address)
+            return address.address;
+    }
+    return '127.0.0.1';
+}
+/**
+ * A STUN and TURN server inside the application (RFC 8489, RFC 8656): over UDP and TCP on port 3478, and over TLS when
+ * given a certificate. The browsers and the other clients use it to find their public address (STUN) and to relay their
+ * traffic when they cannot connect directly (TURN). It authenticates the clients with short-lived credentials made
+ * with its secret ({@link TURNServer.credentials}), as coturn's REST API does, and with the fixed users of its options;
+ * both use the SHA-1 integrity of RFC 5389, which the browsers require.
+ *
+ * Register it with {@link buildTURNServerOptions} and list it in `bootstrap` so that it listens when the application
+ * starts; the `Signaling` component gives its ICE servers and credentials to the members of the rooms. With a
+ * `cluster`, the server tells the other nodes where it is and how many allocations it has, and the signaling of every
+ * node gives the members the least loaded TURN servers of the cluster.
+ * @example
+ * ```typescript
+ * import {Application} from 'lakutata'
+ * import {buildTURNServerOptions, type TURNServer} from '@lakutata/webrtc'
+ *
+ * Application
+ *     .run(() => ({
+ *         id: 'turn.app',
+ *         name: 'TURN',
+ *         components: {
+ *             //UDP and TCP on 3478, the relays on 49160-49200, reached at the public address of the host
+ *             turn: buildTURNServerOptions({publicAddress: '203.0.113.10', relayPortRange: [49160, 49200], secret: process.env.TURN_SECRET})
+ *         },
+ *         bootstrap: ['turn']
+ *     }))
+ *     .onLaunched(async (app: Application): Promise<void> => {
+ *         const turn: TURNServer = await app.getObject<TURNServer>('turn')
+ *         //The ICE servers of a browser, with credentials for the user alice
+ *         console.log(turn.iceServers('alice'))
+ *     })
+ * ```
+ */
+let TURNServer = class TURNServer extends Component {
+    #server;
+    #workers;
+    #announcer;
+    #clusterObject;
+    #secret;
+    #publicAddress;
+    /**
+     * Start listening.
+     * @protected
+     */
+    async init() {
+        //The servers of a cluster check the credentials made by the other nodes
+        if (this.cluster && !this.secret)
+            throw new InvalidValueException('A TURN server in a cluster needs the secret shared by the TURN servers of the cluster');
+        this.#secret = this.secret ?? randomBytes(32).toString('base64url');
+        this.#publicAddress = this.publicAddress ?? defaultPublicAddress();
+        const options = {
+            host: this.host,
+            port: this.port,
+            udp: this.udp,
+            tcp: this.tcp,
+            relayAddress: this.#publicAddress,
+            relayBindAddress: this.host,
+            relayPortRange: this.relayPortRange,
+            realm: this.realm,
+            //No limit unless given (the engine has one of 256)
+            maxAllocations: this.maxAllocations ?? Infinity,
+            getPassword: (username) => this.users[username] ?? turnPasswordIfValid(this.#secret, username)
+        };
+        if (this.tls)
+            options.tls = { cert: this.tls.cert, key: this.tls.key, port: this.tls.port };
+        if (this.workers) {
+            //Checked on every system, the ports shared or not
+            const ranges = this.#relayPortRanges();
+            if (await portsShareable(this.host))
+                await this.#startWorkers(options, ranges);
+            else
+                log('the ports cannot be shared among threads here (SO_REUSEPORT): the server relays in the main thread, not in %d worker threads', this.workers);
+        }
+        if (!this.#workers) {
+            this.#server = new NodeTurnServer(options);
+            await this.#server.listen();
+        }
+        if (this.cluster) {
+            const cluster = await this.getObject(this.cluster);
+            this.#clusterObject = cluster;
+            this.announce();
+            this.#announcer = setInterval(() => this.announce(), ANNOUNCE_INTERVAL);
+            this.#announcer.unref();
+        }
+    }
+    /**
+     * Leave the cluster, stop listening and close the relays.
+     * @protected
+     */
+    async destroy() {
+        clearInterval(this.#announcer);
+        this.#clusterObject?.announce('turn', undefined);
+        await this.#workers?.stop();
+        await this.#server?.close();
+    }
+    /**
+     * The part of the relay ports of each worker thread
+     * @throws {RangeError} When the range has fewer ports than there are threads.
+     */
+    #relayPortRanges() {
+        return Array.from({ length: this.workers }, (_, index) => {
+            if (!this.relayPortRange)
+                return undefined;
+            const [first, last] = this.relayPortRange;
+            const size = last - first + 1;
+            if (size < this.workers)
+                throw new RangeError(`The relay port range has ${size} ports, fewer than the ${this.workers} worker threads`);
+            return [first + Math.floor(index * size / this.workers), first + Math.floor((index + 1) * size / this.workers) - 1];
+        });
+    }
+    /**
+     * Start the worker threads, each with its part of the relay ports and the credentials (functions stay in the main
+     * thread)
+     * @param options The options of the server of each thread.
+     * @param ranges The part of the relay ports of each.
+     */
+    async #startWorkers(options, ranges) {
+        const { getPassword, ...shared } = options;
+        const allocations = new SharedArrayBuffer(Int32Array.BYTES_PER_ELEMENT * (1 + this.workers));
+        const workers = new TURNWorkers(ranges.map((range, thread) => ({
+            thread: thread,
+            //A Buffer given to a thread arrives as a Uint8Array: the certificate and its key in PEM, as text
+            options: { ...shared, relayPortRange: range, ...this.tls ? { tls: { ...shared.tls, cert: this.tls.cert.toString(), key: this.tls.key.toString() } } : {} },
+            users: this.users,
+            secret: this.#secret,
+            allocations: allocations
+        })));
+        try {
+            await workers.start();
+        }
+        catch (error) {
+            await workers.stop();
+            throw error;
+        }
+        this.#workers = workers;
+        turnWorkers.set(this, workers);
+    }
+    /**
+     * Tell the other nodes of the cluster where the server is and its load (sent with the next heartbeat).
+     * @protected
+     */
+    announce() {
+        this.#clusterObject?.announce('turn', {
+            ...this.location,
+            allocations: this.allocations,
+            maxAllocations: this.maxAllocations,
+            credentialTtl: this.credentialTtl
+        });
+    }
+    /**
+     * The address and the port of STUN and TURN over UDP and TCP, as the clients reach them (the public address).
+     */
+    get address() {
+        return { address: this.#publicAddress, port: (this.#workers ? this.#workers.port : this.#server?.address?.[1]) ?? this.port };
+    }
+    /**
+     * The address and the port of TURN over TLS, as the clients reach them; undefined without TLS.
+     */
+    get tlsAddress() {
+        const port = this.#workers ? this.#workers.tlsPort : this.#server?.tlsAddress?.[1];
+        return port !== undefined ? { address: this.#publicAddress, port: port } : undefined;
+    }
+    /**
+     * Where the clients reach the server: its public address, its ports.
+     */
+    get location() {
+        const { address, port } = this.address;
+        const tls = this.tlsAddress;
+        return { address: address, port: port, udp: this.udp, tcp: this.tcp, ...tls ? { tlsPort: tls.port } : {} };
+    }
+    /**
+     * The allocations in use: the clients relaying their traffic through the server.
+     */
+    get allocations() {
+        return this.#workers ? this.#workers.allocations : this.#server?.protocol.allocationCount ?? 0;
+    }
+    /**
+     * Create short-lived credentials for a user, valid for `credentialTtl` seconds.
+     * @param user The user (the part of the username after the expiry).
+     * @returns The username, the password and their lifetime in seconds.
+     * @example
+     * ```typescript
+     * import type {TURNServer, TURNCredentials} from '@lakutata/webrtc'
+     *
+     * declare const turn: TURNServer
+     * const credentials: TURNCredentials = turn.credentials('alice')
+     * ```
+     */
+    credentials(user = 'anonymous') {
+        return createTURNCredentials(this.#secret, user, this.credentialTtl);
+    }
+    /**
+     * The ICE servers of a client, as `RTCIceServer` objects: STUN, then TURN over UDP and TCP, then over TLS when it
+     * listens over TLS, with short-lived credentials for the user.
+     * @param user The user the credentials are for.
+     * @returns The ICE servers.
+     * @example
+     * ```typescript
+     * import type {SignalingIceServer, TURNServer} from '@lakutata/webrtc'
+     *
+     * declare const turn: TURNServer
+     * //[{urls: 'stun:203.0.113.10:3478'}, {urls: ['turn:203.0.113.10:3478?transport=udp', …], username, credential}]
+     * const iceServers: SignalingIceServer[] = turn.iceServers('alice')
+     * ```
+     */
+    iceServers(user = 'anonymous') {
+        return iceServersOfTURN(this.location, this.credentials(user));
+    }
+};
+__decorate([
+    Configurable(DTO.String().optional().default('0.0.0.0')),
+    __metadata("design:type", String)
+], TURNServer.prototype, "host", void 0);
+__decorate([
+    Configurable(DTO.Number().port().optional().default(3478)),
+    __metadata("design:type", Number)
+], TURNServer.prototype, "port", void 0);
+__decorate([
+    Configurable(DTO.Boolean().optional().default(true)),
+    __metadata("design:type", Boolean)
+], TURNServer.prototype, "udp", void 0);
+__decorate([
+    Configurable(DTO.Boolean().optional().default(true)),
+    __metadata("design:type", Boolean)
+], TURNServer.prototype, "tcp", void 0);
+__decorate([
+    Configurable(DTO.Object({
+        cert: DTO.Alternatives(DTO.String(), DTO.Binary()).required(),
+        key: DTO.Alternatives(DTO.String(), DTO.Binary()).required(),
+        port: DTO.Number().port().optional()
+    }).optional()),
+    __metadata("design:type", Object)
+], TURNServer.prototype, "tls", void 0);
+__decorate([
+    Configurable(DTO.String().optional()),
+    __metadata("design:type", String)
+], TURNServer.prototype, "publicAddress", void 0);
+__decorate([
+    Configurable(DTO.Array().items(DTO.Number().port()).length(2).optional()),
+    __metadata("design:type", Array)
+], TURNServer.prototype, "relayPortRange", void 0);
+__decorate([
+    Configurable(DTO.String().min(1).optional()),
+    __metadata("design:type", String)
+], TURNServer.prototype, "secret", void 0);
+__decorate([
+    Configurable(DTO.Object().pattern(DTO.String(), DTO.String()).optional().default({})),
+    __metadata("design:type", Object)
+], TURNServer.prototype, "users", void 0);
+__decorate([
+    Configurable(DTO.String().optional().default('lakutata')),
+    __metadata("design:type", String)
+], TURNServer.prototype, "realm", void 0);
+__decorate([
+    Configurable(DTO.Number().integer().positive().optional().default(86400)),
+    __metadata("design:type", Number)
+], TURNServer.prototype, "credentialTtl", void 0);
+__decorate([
+    Configurable(DTO.Number().integer().positive().optional()),
+    __metadata("design:type", Number)
+], TURNServer.prototype, "maxAllocations", void 0);
+__decorate([
+    Configurable(DTO.Number().integer().min(0).optional().default(0)),
+    __metadata("design:type", Number)
+], TURNServer.prototype, "workers", void 0);
+__decorate([
+    Configurable(DTO.String().optional()),
+    __metadata("design:type", String)
+], TURNServer.prototype, "cluster", void 0);
+TURNServer = __decorate([
+    Singleton()
+], TURNServer);
+export { TURNServer };
+/**
+ * Build the options of a {@link TURNServer} component, for the `components` of an application.
+ * @param options Where it listens, the address the clients reach it at, the relay ports, the credentials (all optional).
+ * @returns The component options.
+ * @example
+ * ```typescript
+ * import {Application} from 'lakutata'
+ * import {buildTURNServerOptions} from '@lakutata/webrtc'
+ *
+ * Application.run(() => ({
+ *     id: 'turn.app',
+ *     name: 'TURN',
+ *     components: {
+ *         turn: buildTURNServerOptions({publicAddress: '203.0.113.10', secret: process.env.TURN_SECRET})
+ *     },
+ *     bootstrap: ['turn']
+ * }))
+ * ```
+ */
+export function buildTURNServerOptions(options = {}) {
+    return { class: TURNServer, ...options };
+}

package/dist/esm/turn/TURNWorker.js

@@ -0,0 +1,49 @@
+import { format } from 'node:util';
+import { parentPort, workerData } from 'node:worker_threads';
+import { setDebugHandler } from '../lib/common/log.js';
+import { NodeTurnServer } from '../lib/turn/node/turnServer.js';
+import { turnPasswordIfValid } from './TURNCredentials.js';
+/**
+ * Serve TURN in a worker thread: a server whose listeners share their ports with the ones of the other threads (the
+ * system keeps each client on one), the allocations counted with theirs against maxAllocations
+ */
+export function runTURNWorker() {
+    if (!parentPort)
+        throw new Error('The TURN server serves in a worker thread only');
+    const port = parentPort;
+    const data = workerData;
+    const counts = new Int32Array(data.allocations);
+    const own = 1 + data.thread;
+    const maxAllocations = data.options.maxAllocations ?? Infinity;
+    const server = new NodeTurnServer({
+        ...data.options,
+        reusePort: true,
+        getPassword: (username) => data.users[username] ?? turnPasswordIfValid(data.secret, username),
+        allocationGate: {
+            reserve: () => {
+                if (Atomics.add(counts, 0, 1) < maxAllocations) {
+                    Atomics.add(counts, own, 1);
+                    return true;
+                }
+                Atomics.sub(counts, 0, 1);
+                return false;
+            },
+            release: () => {
+                Atomics.sub(counts, 0, 1);
+                Atomics.sub(counts, own, 1);
+            }
+        }
+    });
+    const post = (message) => port.postMessage(message);
+    port.on('message', (message) => {
+        if (message.type === 'debug') {
+            //The debug messages go to the handler of the main thread while it has one
+            setDebugHandler(message.enabled
+                ? (namespace, args) => post({ type: 'log', namespace: namespace, message: `[thread ${data.thread}] ${format(...args)}` })
+                : undefined);
+            return;
+        }
+        server.close().then(() => post({ type: 'stopped' }), () => post({ type: 'stopped' }));
+    });
+    server.listen().then(() => post({ type: 'ready', port: server.address?.[1], tlsPort: server.tlsAddress?.[1] }), (error) => post({ type: 'failed', error: error instanceof Error ? error.message : String(error) }));
+}