@lakutata/webrtc 0.0.0-stage → 3.1.4

package/dist/cjs/lib/ice/turn/protocol.js

@@ -0,0 +1,638 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TurnProtocol = exports.StunOverTurnProtocol = void 0;
+exports.createTurnClient = createTurnClient;
+exports.createStunOverTurnClient = createStunOverTurnClient;
+exports.makeIntegrityKey = makeIntegrityKey;
+const node_net_1 = require("node:net");
+const promises_1 = require("node:timers/promises");
+const auth_js_1 = require("../../turn/turn/auth.js");
+const exceptions_js_1 = require("../exceptions.js");
+const helper_js_1 = require("../helper.js");
+const common_js_1 = require("../imports/common.js");
+const const_js_1 = require("../stun/const.js");
+const message_js_1 = require("../stun/message.js");
+const transaction_js_1 = require("../stun/transaction.js");
+const frame_js_1 = require("./frame.js");
+const log = (0, common_js_1.debug)('webrtc/ice/turn/protocol');
+const DEFAULT_CHANNEL_REFRESH_TIME = 500;
+/**How long closing waits for the server to delete the allocation (ms) */
+const DELETE_TIMEOUT = 1000;
+const DEFAULT_ALLOCATION_LIFETIME = 600;
+const UDP_TRANSPORT = 0x11000000;
+function isStreamTransport(transport) {
+    return transport.type === 'tcp' || transport.type === 'tls';
+}
+/** Permission is peer-IP scoped (RFC 8656). */
+function permissionKey(addr) {
+    return addr[0];
+}
+/** ChannelBind is peer transport-address scoped (IP + port). */
+function channelKey(addr) {
+    return JSON.stringify(addr);
+}
+class StunOverTurnProtocol {
+    static { this.type = 'turn'; }
+    constructor(turn) {
+        this.turn = turn;
+        this.type = StunOverTurnProtocol.type;
+        this.disposer = new common_js_1.EventDisposer();
+        this.onRequestReceived = new common_js_1.Event();
+        this.onDataReceived = new common_js_1.Event();
+        this.handleStunMessage = (data, addr) => {
+            try {
+                const message = (0, message_js_1.parseMessage)(data);
+                if (!message) {
+                    this.onDataReceived.execute(data);
+                    return;
+                }
+                if (message.messageClass === const_js_1.classes.RESPONSE ||
+                    message.messageClass === const_js_1.classes.ERROR) {
+                    const transaction = this.turn.transactions[message.transactionIdHex];
+                    if (transaction) {
+                        const verified = transaction.integrityKey
+                            ? (0, message_js_1.parseMessage)(data, transaction.integrityKey)
+                            : message;
+                        if (!verified) {
+                            log('STUN over TURN response failed MESSAGE-INTEGRITY check');
+                            return;
+                        }
+                        transaction.responseReceived(verified, addr);
+                    }
+                }
+                else if (message.messageClass === const_js_1.classes.REQUEST) {
+                    this.onRequestReceived.execute(message, addr, data);
+                }
+            }
+            catch (error) {
+                log('datagramReceived error', error);
+            }
+        };
+        turn.onData
+            .subscribe((data, addr) => {
+            this.handleStunMessage(data, addr);
+        })
+            .disposer(this.disposer);
+    }
+    async request(request, addr, integrityKey, retransmissionsOrOptions, onRequestSent) {
+        if (this.turn.transactions[request.transactionIdHex]) {
+            throw new Error('exist');
+        }
+        if (integrityKey) {
+            request.addMessageIntegrity(integrityKey);
+            request.addFingerprint();
+        }
+        // Peer-facing STUN over TURN must honor retransmissions/responseTimeout
+        // (consent uses retransmissions: 0). Do not confuse with TURN server
+        // allocation/refresh policy on TurnProtocol.
+        // Peer addresses are already IPs from candidates; resolve for safety.
+        const resolvedAddr = await (0, transaction_js_1.resolveRequestAddress)(addr);
+        const options = (0, transaction_js_1.buildTransactionOptions)(integrityKey, retransmissionsOrOptions, onRequestSent);
+        const transaction = new transaction_js_1.Transaction(request, resolvedAddr, this, options);
+        this.turn.transactions[request.transactionIdHex] = transaction;
+        try {
+            return await transaction.run();
+        }
+        finally {
+            delete this.turn.transactions[request.transactionIdHex];
+        }
+    }
+    async connectionMade() { }
+    async sendData(data, addr) {
+        await this.turn.sendData(data, addr);
+    }
+    async sendStun(message, addr) {
+        await this.turn.sendData(message.bytes, addr);
+    }
+    async close() {
+        this.disposer.dispose();
+        return this.turn.close();
+    }
+}
+exports.StunOverTurnProtocol = StunOverTurnProtocol;
+class TurnProtocol {
+    static { this.type = 'turn'; }
+    constructor(
+    /** TURN server as configured; the host may be a hostname. */
+    server, username, password, lifetime, transport, options = {}) {
+        this.server = server;
+        this.username = username;
+        this.password = password;
+        this.lifetime = lifetime;
+        this.transport = transport;
+        this.options = options;
+        this.type = TurnProtocol.type;
+        this.onData = new common_js_1.Event();
+        this.onRequestReceived = new common_js_1.Event();
+        this.onDataReceived = new common_js_1.Event();
+        this.transactions = {};
+        /**When the allocation expires unless refreshed (ms since epoch), 0 when there is none */
+        this.expiresAt = 0;
+        this.channelNumber = 0x4000;
+        this.channelByAddr = {};
+        this.addrByChannel = {};
+        /**
+       * Serializes ChannelBind requests so allocation-wide auth state
+       * (nonce/realm/integrityKey) is not updated concurrently. Rejections
+       * must not poison this tail — see channelBindQueue assignment sites.
+       */
+        this.channelBindQueue = Promise.resolve();
+        /** In-flight ChannelBind per peer transport address (dedupe concurrent). */
+        this.channelBindingByAddr = new Map();
+        this.tcpBuffer = Buffer.alloc(0);
+        /** Permission cache keyed by peer IP only (RFC 8656). */
+        this.permissionByAddr = {};
+        /**
+       * Serializes CreatePermission requests (auth state race avoidance).
+       * Rejections must not poison this tail.
+       */
+        this.permissionQueue = Promise.resolve();
+        /** In-flight CreatePermission per peer IP (dedupe concurrent). */
+        this.creatingPermissionByAddr = new Map();
+        this.refresh = (exp) => {
+            this.refreshHandle = (0, helper_js_1.cancelable)(async (_, __, onCancel) => {
+                const abort = new AbortController();
+                onCancel.once(() => {
+                    abort.abort();
+                });
+                while (!abort.signal.aborted) {
+                    // refresh before expire
+                    const delay = (5 / 6) * exp * 1000;
+                    log('refresh delay', delay, { exp });
+                    try {
+                        await (0, promises_1.setTimeout)(delay, undefined, { signal: abort.signal });
+                    }
+                    catch (error) {
+                        if (abort.signal.aborted) {
+                            return;
+                        }
+                        throw error;
+                    }
+                    if (abort.signal.aborted) {
+                        return;
+                    }
+                    const request = new message_js_1.Message(const_js_1.methods.REFRESH, const_js_1.classes.REQUEST);
+                    request.setAttribute('LIFETIME', exp);
+                    try {
+                        const [message] = await this.requestWithRetry(request, this.server, abort.signal);
+                        exp = message.getAttributeValue('LIFETIME');
+                        log('refresh', { exp });
+                        this.expiresAt = Date.now() + exp * 1000;
+                    }
+                    catch (error) {
+                        if (abort.signal.aborted) {
+                            return;
+                        }
+                        log('refresh error', error);
+                    }
+                }
+            });
+        };
+        this.channelRefreshTime =
+            this.options.channelRefreshTime ?? DEFAULT_CHANNEL_REFRESH_TIME;
+    }
+    async connectionMade() {
+        this.transport.onData = (data, addr) => {
+            this.dataReceived(data, addr);
+        };
+        const request = new message_js_1.Message(const_js_1.methods.ALLOCATE, const_js_1.classes.REQUEST);
+        request
+            .setAttribute('LIFETIME', this.lifetime)
+            .setAttribute('REQUESTED-TRANSPORT', UDP_TRANSPORT);
+        const [response] = await this.requestWithRetry(request, this.server).catch((e) => {
+            log('connect error', e);
+            throw e;
+        });
+        this.relayedAddress = response.getAttributeValue('XOR-RELAYED-ADDRESS');
+        this.mappedAddress = response.getAttributeValue('XOR-MAPPED-ADDRESS');
+        const exp = response.getAttributeValue('LIFETIME');
+        log('connect', this.relayedAddress, this.mappedAddress, { exp });
+        this.expiresAt = Date.now() + exp * 1000;
+        this.refresh(exp);
+    }
+    handleChannelData(data) {
+        const decoded = (0, frame_js_1.decodeChannelData)(data);
+        const addr = decoded && this.addrByChannel[decoded.channelNumber];
+        if (addr && decoded) {
+            this.onData.execute(decoded.data, addr);
+        }
+    }
+    handleSTUNMessage(data, addr) {
+        try {
+            const message = (0, message_js_1.parseMessage)(data);
+            if (!message) {
+                throw new Error('not stun message');
+            }
+            if (message.messageClass === const_js_1.classes.RESPONSE ||
+                message.messageClass === const_js_1.classes.ERROR) {
+                const transaction = this.transactions[message.transactionIdHex];
+                if (transaction) {
+                    //A challenge (a new nonce) comes without MESSAGE-INTEGRITY
+                    const verified = transaction.integrityKey && !(0, transaction_js_1.isChallenge)(message)
+                        ? (0, message_js_1.parseMessage)(data, transaction.integrityKey)
+                        : message;
+                    if (!verified) {
+                        log('TURN STUN response failed MESSAGE-INTEGRITY check');
+                        return;
+                    }
+                    transaction.responseReceived(verified, addr);
+                }
+            }
+            else if (message.messageClass === const_js_1.classes.REQUEST) {
+                this.onData.execute(data, addr);
+            }
+            if (message.getAttributeValue('DATA')) {
+                const buf = message.getAttributeValue('DATA');
+                const peerAddress = message.getAttributeValue('XOR-PEER-ADDRESS') ?? addr;
+                this.onData.execute(buf, peerAddress);
+            }
+        }
+        catch (error) {
+            log('parse error', data.toString());
+        }
+    }
+    dataReceived(data, addr) {
+        const datagramReceived = (data, addr) => {
+            if (data.length >= 4 && (0, frame_js_1.isChannelData)(data)) {
+                this.handleChannelData(data);
+            }
+            else {
+                this.handleSTUNMessage(data, addr);
+            }
+        };
+        if (isStreamTransport(this.transport)) {
+            this.tcpBuffer = Buffer.concat([this.tcpBuffer, data]);
+            const { frames, rest } = (0, frame_js_1.splitTurnTcpFrames)(this.tcpBuffer);
+            this.tcpBuffer = rest;
+            for (const frame of frames) {
+                datagramReceived(frame, addr);
+            }
+        }
+        else {
+            datagramReceived(data, addr);
+        }
+    }
+    async send(data, addr) {
+        if (this.transport.closed) {
+            return;
+        }
+        await this.transport.send(isStreamTransport(this.transport) ? (0, frame_js_1.padTurnFrame)(data) : data, addr);
+    }
+    async createPermission(peerAddress) {
+        const request = new message_js_1.Message(const_js_1.methods.CREATE_PERMISSION, const_js_1.classes.REQUEST);
+        request
+            .setAttribute('XOR-PEER-ADDRESS', peerAddress)
+            .setAttribute('USERNAME', this.username)
+            .setAttribute('REALM', this.realm)
+            .setAttribute('NONCE', this.nonce);
+        // Use requestWithRetry for stale-nonce (438) consistency with ChannelBind.
+        await this.requestWithRetry(request, this.server);
+    }
+    async request(request, addr, _integrityKey, retransmissionsOrOptions, onRequestSent) {
+        if (this.transactions[request.transactionIdHex]) {
+            throw new Error('exist');
+        }
+        if (this.integrityKey) {
+            request
+                .setAttribute('USERNAME', this.username)
+                .setAttribute('REALM', this.realm)
+                .setAttribute('NONCE', this.nonce)
+                .addMessageIntegrity(this.integrityKey)
+                .addFingerprint();
+        }
+        // TURN server allocation/refresh uses default STUN retry policy unless
+        // callers pass explicit options. Peer consent goes through StunOverTurnProtocol.
+        // Prefer the TURN session integrity key for response verification.
+        const resolvedAddr = await this.resolveRequestTarget(addr);
+        const options = (0, transaction_js_1.buildTransactionOptions)(this.integrityKey, retransmissionsOrOptions, onRequestSent);
+        const transaction = new transaction_js_1.Transaction(request, resolvedAddr, this, options);
+        this.transactions[request.transactionIdHex] = transaction;
+        try {
+            return await transaction.run();
+        }
+        finally {
+            delete this.transactions[request.transactionIdHex];
+        }
+    }
+    /**
+   * The concrete TURN server address, selected on the first request and
+   * pinned for the rest of the allocation, so a later DNS answer can never
+   * move REFRESH, CREATE_PERMISSION, CHANNEL_BIND or data to another server.
+   */
+    get serverEndpoint() {
+        return this.pinnedServerEndpoint;
+    }
+    /**
+   * Address a request to `addr` is sent to, and the address its response
+   * must come from. A stream carries every request to the peer it is
+   * connected to, so it always uses the server endpoint.
+   */
+    async resolveRequestTarget(addr) {
+        if (isStreamTransport(this.transport) || (0, transaction_js_1.addressEquals)(addr, this.server)) {
+            return this.selectServerEndpoint();
+        }
+        return (0, transaction_js_1.resolveRequestAddress)(addr, this.transport.addressFamily ?? 0);
+    }
+    async serverDestination() {
+        return this.pinnedServerEndpoint ?? this.selectServerEndpoint();
+    }
+    selectServerEndpoint() {
+        this.serverEndpointSelection ??= this.resolveServerEndpoint().then((endpoint) => {
+            this.pinnedServerEndpoint = endpoint;
+            return endpoint;
+        }, (error) => {
+            // Let a later request try again, e.g. after a transient DNS failure.
+            this.serverEndpointSelection = undefined;
+            throw error;
+        });
+        return this.serverEndpointSelection;
+    }
+    /**
+   * UDP: resolve the configured server in the bound socket's family; a udp4
+   * socket cannot send to an IPv6 answer. TCP/TLS: use the peer the socket
+   * actually connected to. Looking the hostname up again could return a
+   * different A/AAAA record, and responses from the real peer would then be
+   * dropped as coming from an unexpected address.
+   */
+    async resolveServerEndpoint() {
+        const transport = this.transport;
+        if (!isStreamTransport(transport)) {
+            return (0, transaction_js_1.resolveRequestAddress)(this.server, transport.addressFamily ?? 0);
+        }
+        if (transport.remoteAddress) {
+            return transport.remoteAddress;
+        }
+        if (transport instanceof common_js_1.TcpTransport ||
+            transport instanceof common_js_1.TlsTransport) {
+            throw new Error(`${transport.type} transport has no remote address`);
+        }
+        // A custom stream transport that does not report its peer: fall back to
+        // a lookup with no family preference.
+        return (0, transaction_js_1.resolveRequestAddress)(this.server);
+    }
+    async requestWithRetry(request, addr, signal) {
+        let message, address;
+        try {
+            [message, address] = await this.request(request, addr, undefined, {
+                signal
+            });
+        }
+        catch (error) {
+            if (error instanceof exceptions_js_1.TransactionFailed == false) {
+                log('requestWithRetry error', error);
+                throw error;
+            }
+            const [errorCode] = error.response.getAttributeValue('ERROR-CODE');
+            const nonce = error.response.getAttributeValue('NONCE');
+            const realm = error.response.getAttributeValue('REALM');
+            if (((errorCode === 401 && realm) || (errorCode === 438 && this.realm)) &&
+                nonce) {
+                log('retry with nonce', errorCode);
+                this.nonce = nonce;
+                if (errorCode === 401) {
+                    this.realm = realm;
+                }
+                this.integrityKey = makeIntegrityKey(this.username, this.realm, this.password);
+                request.transactionId = (0, helper_js_1.randomTransactionId)();
+                [message, address] = await this.request(request, this.server, undefined, { signal });
+            }
+            else {
+                throw error;
+            }
+        }
+        return [message, address];
+    }
+    async sendData(data, addr) {
+        let channel;
+        try {
+            channel = await this.getChannel(addr);
+        }
+        catch (e) {
+            // Keep original ChannelBind error for diagnostics (403/438/timeout).
+            log('channelBind error; falling back to Send Indication', e);
+        }
+        if (!channel) {
+            await this.getPermission(addr);
+            const indicate = new message_js_1.Message(const_js_1.methods.SEND, const_js_1.classes.INDICATION)
+                .setAttribute('DATA', data)
+                .setAttribute('XOR-PEER-ADDRESS', addr);
+            await this.sendStun(indicate, await this.serverDestination());
+            return;
+        }
+        await this.send((0, frame_js_1.encodeChannelData)(channel.number, data), await this.serverDestination());
+    }
+    /**
+   * Ensure a CreatePermission exists for the peer IP.
+   * Peer failures are isolated: a rejection for peer A does not poison peer B.
+   */
+    async getPermission(addr) {
+        const key = permissionKey(addr);
+        if (this.permissionByAddr[key]) {
+            return;
+        }
+        const existing = this.creatingPermissionByAddr.get(key);
+        if (existing) {
+            return existing;
+        }
+        const operation = this.permissionQueue.then(async () => {
+            // Another caller may have succeeded while we waited on the queue.
+            if (this.permissionByAddr[key]) {
+                return;
+            }
+            await this.createPermission(addr);
+            // Cache only after successful CreatePermission.
+            this.permissionByAddr[key] = true;
+        });
+        // Do not let rejection poison subsequent peers on the shared queue.
+        this.permissionQueue = operation.then(() => undefined, () => undefined);
+        this.creatingPermissionByAddr.set(key, operation);
+        try {
+            await operation;
+        }
+        catch (error) {
+            log('createPermission error', error);
+            throw error;
+        }
+        finally {
+            if (this.creatingPermissionByAddr.get(key) === operation) {
+                this.creatingPermissionByAddr.delete(key);
+            }
+        }
+    }
+    /**
+   * Ensure a ChannelBind exists for the peer transport address.
+   * Peer failures are isolated; concurrent same-peer calls share one Promise.
+   */
+    async getChannel(addr) {
+        const key = channelKey(addr);
+        const existing = this.channelBindingByAddr.get(key);
+        if (existing) {
+            return existing;
+        }
+        // Fast path: bound and not due for refresh.
+        const cached = this.channelByAddr[key];
+        const now = (0, common_js_1.int)(Date.now() / 1000);
+        if (cached && cached.refreshAt > now) {
+            return cached;
+        }
+        const operation = this.channelBindQueue.then(() => this.ensureChannel(addr));
+        // Do not let rejection poison subsequent peers on the shared queue.
+        this.channelBindQueue = operation.then(() => undefined, () => undefined);
+        this.channelBindingByAddr.set(key, operation);
+        try {
+            return await operation;
+        }
+        catch (error) {
+            log('channelBind error', error);
+            throw error;
+        }
+        finally {
+            if (this.channelBindingByAddr.get(key) === operation) {
+                this.channelBindingByAddr.delete(key);
+            }
+        }
+    }
+    /**
+   * Create or refresh a channel for addr. Provisional mapping is installed
+   * before the request so early ChannelData can be decoded; only a failed
+   * *initial* bind rolls the mapping back. Failed channel numbers are never
+   * reused.
+   */
+    async ensureChannel(addr) {
+        const key = channelKey(addr);
+        const now = (0, common_js_1.int)(Date.now() / 1000);
+        let channel = this.channelByAddr[key];
+        if (channel && channel.refreshAt > now) {
+            return channel;
+        }
+        const isNew = !channel;
+        if (!channel) {
+            channel = {
+                number: this.channelNumber++,
+                address: addr,
+                refreshAt: 0
+            };
+            // Provisional mapping for ChannelData that may arrive before success.
+            this.channelByAddr[key] = channel;
+            this.addrByChannel[channel.number] = addr;
+        }
+        try {
+            await this.channelBind(channel.number, addr);
+            channel.refreshAt = (0, common_js_1.int)(Date.now() / 1000) + this.channelRefreshTime;
+            log(isNew ? 'channelBind' : 'channelBind refresh', channel);
+            return channel;
+        }
+        catch (error) {
+            if (isNew) {
+                // Roll back provisional mapping only for a failed initial bind.
+                delete this.channelByAddr[key];
+                delete this.addrByChannel[channel.number];
+                // Do not reuse the channel number (no channelNumber--).
+            }
+            throw error;
+        }
+    }
+    async channelBind(channelNumber, addr) {
+        const request = new message_js_1.Message(const_js_1.methods.CHANNEL_BIND, const_js_1.classes.REQUEST);
+        request
+            .setAttribute('CHANNEL-NUMBER', channelNumber)
+            .setAttribute('XOR-PEER-ADDRESS', addr);
+        const [response] = await this.requestWithRetry(request, this.server);
+        if (response.messageMethod !== const_js_1.methods.CHANNEL_BIND) {
+            throw new Error('should be CHANNEL_BIND');
+        }
+    }
+    async sendStun(message, addr) {
+        await this.send(message.bytes, addr);
+    }
+    /**
+   * Refresh the allocation now.
+   * @returns Whether the server still has it.
+   */
+    async refreshAllocation() {
+        if (!this.expiresAt || this.transport.closed) {
+            return false;
+        }
+        const request = new message_js_1.Message(const_js_1.methods.REFRESH, const_js_1.classes.REQUEST);
+        request.setAttribute('LIFETIME', this.lifetime);
+        try {
+            const [message] = await this.requestWithRetry(request, this.server);
+            this.expiresAt = Date.now() + message.getAttributeValue('LIFETIME') * 1000;
+            return true;
+        }
+        catch (error) {
+            log('refresh failed', error);
+            this.expiresAt = 0;
+            return false;
+        }
+    }
+    async close() {
+        this.refreshHandle?.resolve?.();
+        //Delete the allocation on the server (a refresh with a lifetime of 0, RFC 8656 section 7), waiting a second at
+        //most for the answer
+        if (this.expiresAt > Date.now() && !this.transport.closed) {
+            this.expiresAt = 0;
+            const request = new message_js_1.Message(const_js_1.methods.REFRESH, const_js_1.classes.REQUEST);
+            request.setAttribute('LIFETIME', 0);
+            await this.requestWithRetry(request, this.server, AbortSignal.timeout(DELETE_TIMEOUT)).catch((error) => {
+                log('delete allocation', error);
+            });
+        }
+        await this.transport.close();
+    }
+}
+exports.TurnProtocol = TurnProtocol;
+/**
+ * Select the UDP socket type for a TURN server.
+ * Precedence: IP literal family > udpFamily > 4.
+ * An IP literal fixes the destination family, so a conflicting udpFamily is
+ * ignored (and logged) rather than making the server unreachable.
+ */
+function selectTurnUdpSocketType(address, udpFamily) {
+    const literalFamily = (0, node_net_1.isIP)(address[0]);
+    if (literalFamily === 4 || literalFamily === 6) {
+        if (udpFamily && udpFamily !== literalFamily) {
+            log('udpFamily ignored for IP literal TURN server', {
+                address,
+                udpFamily,
+                literalFamily
+            });
+        }
+        return literalFamily === 6 ? 'udp6' : 'udp4';
+    }
+    return (udpFamily ?? 4) === 6 ? 'udp6' : 'udp4';
+}
+async function createTurnClient({ address, username, password }, { lifetime, portRange, interfaceAddresses, ssl, tlsOptions, transport: transportType, connectTimeoutMs, udpFamily } = {}) {
+    lifetime ??= DEFAULT_ALLOCATION_LIFETIME;
+    transportType ??= ssl ? 'tls' : 'udp';
+    const transport = transportType === 'udp'
+        ? await common_js_1.UdpTransport.init(selectTurnUdpSocketType(address, udpFamily), {
+            portRange,
+            interfaceAddresses
+        })
+        : transportType === 'tcp'
+            ? await common_js_1.TcpTransport.init(address, { connectTimeoutMs })
+            : await common_js_1.TlsTransport.init(address, tlsOptions, { connectTimeoutMs });
+    const turn = new TurnProtocol(address, username, password, lifetime, transport);
+    try {
+        await turn.connectionMade();
+    }
+    catch (error) {
+        try {
+            await turn.close();
+        }
+        catch (closeError) {
+            log('failed to close TURN client after allocation failure', closeError);
+        }
+        throw error;
+    }
+    return turn;
+}
+async function createStunOverTurnClient(config, options = {}) {
+    const turn = await createTurnClient(config, options);
+    const turnTransport = new StunOverTurnProtocol(turn);
+    return turnTransport;
+}
+function makeIntegrityKey(username, realm, password) {
+    return (0, auth_js_1.makeTurnIntegrityKey)(username, realm, password);
+}

package/dist/cjs/lib/ice/types/model.d.ts

@@ -0,0 +1,56 @@
+import type { Candidate } from '../candidate.js';
+import type { Address, Event } from '../imports/common.js';
+import type { Message } from '../stun/message.js';
+/**
+ * Options for a STUN transaction / Protocol.request.
+ * Retransmission count and response wait deadline are independent
+ * so consent freshness (retransmissions: 0, longer timeout) can be expressed.
+ */
+export interface TransactionRequestOptions {
+    /** Number of retransmissions after the initial send. 0 = send once. */
+    retransmissions?: number;
+    /**
+   * Initial response wait deadline in milliseconds.
+   * Doubled after each retransmission when retransmissions > 0.
+   * Defaults to RETRY_RTO when omitted.
+   */
+    responseTimeout?: number;
+    /** Called for each wire send (attempt 0 is the initial transmission). */
+    onRequestSent?: (attempt: number) => void;
+    /** Abort the outstanding transaction (e.g. consent lifecycle teardown). */
+    signal?: AbortSignal;
+    /**
+   * Fail the transaction as soon as the request cannot be sent instead of
+   * waiting for the response timeout. Used on reliable transports (TCP),
+   * where a send error means the connection itself is unusable.
+   */
+    failOnSendError?: boolean;
+    /**
+   * When set, responses must include MESSAGE-INTEGRITY and pass HMAC
+   * verification (protocol re-parses the wire bytes with this key; the
+   * transaction also rejects unsigned Messages as defense-in-depth).
+   * Unsigned or forged responses must not complete the transaction.
+   */
+    integrityKey?: Buffer;
+}
+export interface Protocol {
+    type: string;
+    onRequestReceived: Event<[Message, Address, Buffer]>;
+    onDataReceived: Event<[Buffer]>;
+    /** Connection-oriented protocols: the connection to this remote address is gone. */
+    onConnectionClosed?: Event<[Address]>;
+    request: (message: Message, addr: Address, integrityKey?: Buffer, retransmissionsOrOptions?: number | TransactionRequestOptions, onRequestSent?: (attempt: number) => void) => Promise<[Message, Address]>;
+    close: () => Promise<void>;
+    connectionMade: (...args: any) => Promise<void>;
+    sendStun: (message: Message, addr: Address) => Promise<void>;
+    sendData: (data: Buffer, addr: Address) => Promise<void>;
+    /** A socket of its own: send only to the address of the pair selected, once a packet comes from it. */
+    connectTo?: (addr: Address) => void;
+    /** A socket of its own: send to any address again. */
+    disconnect?: () => void;
+    localCandidate?: Candidate;
+    sentMessage?: Message;
+    responseAddr?: Address;
+    responseMessage?: string;
+    localIp?: string;
+}