@lakutata/webrtc 0.0.0-stage → 3.1.4

package/dist/cjs/turn/TURNServer.d.ts

@@ -0,0 +1,309 @@
+import { Component, type ComponentOptions } from '@lakutata/core';
+import type { SignalingIceServer } from '../protocol/SignalingProtocol.js';
+import { type TURNCredentials } from './TURNCredentials.js';
+/**
+ * The TLS listener of a {@link TURNServer} (`turns:`), for the networks letting only TLS through (port 443).
+ */
+export interface TURNServerTLSOptions {
+    /**
+     * The certificate, in PEM.
+     */
+    cert: string | Buffer;
+    /**
+     * Its private key, in PEM.
+     */
+    key: string | Buffer;
+    /**
+     * The TCP port.
+     * @default 5349
+     */
+    port?: number;
+}
+/**
+ * The options of a {@link TURNServer} (see {@link buildTURNServerOptions}).
+ */
+export interface TURNServerOptions {
+    /**
+     * The address the server listens on.
+     * @default '0.0.0.0'
+     */
+    host?: string;
+    /**
+     * The port of STUN and TURN over UDP and TCP.
+     * @default 3478
+     */
+    port?: number;
+    /**
+     * Whether to listen over UDP.
+     * @default true
+     */
+    udp?: boolean;
+    /**
+     * Whether to listen over TCP.
+     * @default true
+     */
+    tcp?: boolean;
+    /**
+     * The TLS listener (`turns:`); none by default.
+     */
+    tls?: TURNServerTLSOptions;
+    /**
+     * The address the clients reach the server at, given in the ICE servers and the relayed addresses: the public
+     * address of the host (or of its NAT, its port mapping forwarding the ports).
+     * @default the first IPv4 address of the host that is not internal, else 127.0.0.1
+     */
+    publicAddress?: string;
+    /**
+     * The UDP ports of the relays, as `[first, last]`: the range published by the container or opened in the firewall.
+     * @default any free port
+     */
+    relayPortRange?: [number, number];
+    /**
+     * The secret of the short-lived credentials ({@link TURNServer.credentials}), shared with the TURN servers of the
+     * other instances (or with a coturn configured with `use-auth-secret`).
+     * @default a random secret, chosen when the server starts
+     */
+    secret?: string;
+    /**
+     * Users with a fixed password, `{username: password}`, besides the short-lived credentials.
+     * @default none
+     */
+    users?: Record<string, string>;
+    /**
+     * The realm of the long-term credentials.
+     * @default 'lakutata'
+     */
+    realm?: string;
+    /**
+     * How long the short-lived credentials are valid, in seconds.
+     * @default 86400 (a day)
+     */
+    credentialTtl?: number;
+    /**
+     * The allocations (relays) at once at most.
+     * @default no limit
+     */
+    maxAllocations?: number;
+    /**
+     * Worker threads that serve the clients, to use more cores: the listeners of the threads share the ports of the
+     * server (`SO_REUSEPORT`), the system keeps each client on one of them, and that thread relays its traffic.
+     * `relayPortRange`, when given, is split among the threads and needs at least one port for each; `maxAllocations`
+     * counts the allocations of all the threads. A thread that stops (only a bug stops one) loses its allocations and
+     * is started again; meanwhile the system spreads the clients over UDP among the threads left, then among all of
+     * them, so most of them find their allocation gone, as when a TURN server restarts (the connections over TCP and
+     * TLS of the other threads stay). The ports can be shared on Linux; elsewhere (macOS, Windows), the server relays
+     * in the main thread and says so in the debug messages (`webrtc/turn`, see `setDebugHandler`). With 0, the server
+     * relays in the main thread.
+     * @default 0
+     */
+    workers?: number;
+    /**
+     * The name of a {@link Cluster} component: the server tells the other nodes its address and its load, and the
+     * `Signaling` and `WHIP` components of all the nodes give it to their clients. It needs a `secret` shared by the
+     * TURN servers of the cluster.
+     * @default none
+     */
+    cluster?: string;
+}
+/**
+ * Where the clients reach a TURN server: its address, the port of UDP and TCP, the port of TLS
+ */
+export interface TURNServerLocation {
+    /**
+     * The address the clients reach it at.
+     */
+    readonly address: string;
+    /**
+     * The port of STUN and TURN over UDP and TCP.
+     */
+    readonly port: number;
+    /**
+     * Whether it listens over UDP.
+     */
+    readonly udp: boolean;
+    /**
+     * Whether it listens over TCP.
+     */
+    readonly tcp: boolean;
+    /**
+     * The port of TURN over TLS, if it listens over TLS.
+     */
+    readonly tlsPort?: number;
+}
+/**
+ * A STUN and TURN server inside the application (RFC 8489, RFC 8656): over UDP and TCP on port 3478, and over TLS when
+ * given a certificate. The browsers and the other clients use it to find their public address (STUN) and to relay their
+ * traffic when they cannot connect directly (TURN). It authenticates the clients with short-lived credentials made
+ * with its secret ({@link TURNServer.credentials}), as coturn's REST API does, and with the fixed users of its options;
+ * both use the SHA-1 integrity of RFC 5389, which the browsers require.
+ *
+ * Register it with {@link buildTURNServerOptions} and list it in `bootstrap` so that it listens when the application
+ * starts; the `Signaling` component gives its ICE servers and credentials to the members of the rooms. With a
+ * `cluster`, the server tells the other nodes where it is and how many allocations it has, and the signaling of every
+ * node gives the members the least loaded TURN servers of the cluster.
+ * @example
+ * ```typescript
+ * import {Application} from 'lakutata'
+ * import {buildTURNServerOptions, type TURNServer} from '@lakutata/webrtc'
+ *
+ * Application
+ *     .run(() => ({
+ *         id: 'turn.app',
+ *         name: 'TURN',
+ *         components: {
+ *             //UDP and TCP on 3478, the relays on 49160-49200, reached at the public address of the host
+ *             turn: buildTURNServerOptions({publicAddress: '203.0.113.10', relayPortRange: [49160, 49200], secret: process.env.TURN_SECRET})
+ *         },
+ *         bootstrap: ['turn']
+ *     }))
+ *     .onLaunched(async (app: Application): Promise<void> => {
+ *         const turn: TURNServer = await app.getObject<TURNServer>('turn')
+ *         //The ICE servers of a browser, with credentials for the user alice
+ *         console.log(turn.iceServers('alice'))
+ *     })
+ * ```
+ */
+export declare class TURNServer extends Component {
+    #private;
+    /**
+     * The address the server listens on.
+     */
+    protected readonly host: string;
+    /**
+     * The port of STUN and TURN over UDP and TCP.
+     */
+    protected readonly port: number;
+    /**
+     * Whether to listen over UDP.
+     */
+    protected readonly udp: boolean;
+    /**
+     * Whether to listen over TCP.
+     */
+    protected readonly tcp: boolean;
+    /**
+     * The TLS listener.
+     */
+    protected readonly tls?: TURNServerTLSOptions;
+    /**
+     * The address the clients reach the server at.
+     */
+    protected readonly publicAddress?: string;
+    /**
+     * The UDP ports of the relays.
+     */
+    protected readonly relayPortRange?: [number, number];
+    /**
+     * The secret of the short-lived credentials.
+     */
+    protected readonly secret?: string;
+    /**
+     * The users with a fixed password.
+     */
+    protected readonly users: Record<string, string>;
+    /**
+     * The realm of the long-term credentials.
+     */
+    protected readonly realm: string;
+    /**
+     * How long the short-lived credentials are valid, in seconds.
+     */
+    protected readonly credentialTtl: number;
+    /**
+     * The allocations at once at most.
+     */
+    protected readonly maxAllocations?: number;
+    /**
+     * The worker threads serving the clients.
+     */
+    protected readonly workers: number;
+    /**
+     * The name of the cluster component.
+     */
+    protected readonly cluster?: string;
+    /**
+     * Start listening.
+     * @protected
+     */
+    protected init(): Promise<void>;
+    /**
+     * Leave the cluster, stop listening and close the relays.
+     * @protected
+     */
+    protected destroy(): Promise<void>;
+    /**
+     * Tell the other nodes of the cluster where the server is and its load (sent with the next heartbeat).
+     * @protected
+     */
+    protected announce(): void;
+    /**
+     * The address and the port of STUN and TURN over UDP and TCP, as the clients reach them (the public address).
+     */
+    get address(): {
+        address: string;
+        port: number;
+    };
+    /**
+     * The address and the port of TURN over TLS, as the clients reach them; undefined without TLS.
+     */
+    get tlsAddress(): {
+        address: string;
+        port: number;
+    } | undefined;
+    /**
+     * Where the clients reach the server: its public address, its ports.
+     */
+    get location(): TURNServerLocation;
+    /**
+     * The allocations in use: the clients relaying their traffic through the server.
+     */
+    get allocations(): number;
+    /**
+     * Create short-lived credentials for a user, valid for `credentialTtl` seconds.
+     * @param user The user (the part of the username after the expiry).
+     * @returns The username, the password and their lifetime in seconds.
+     * @example
+     * ```typescript
+     * import type {TURNServer, TURNCredentials} from '@lakutata/webrtc'
+     *
+     * declare const turn: TURNServer
+     * const credentials: TURNCredentials = turn.credentials('alice')
+     * ```
+     */
+    credentials(user?: string): TURNCredentials;
+    /**
+     * The ICE servers of a client, as `RTCIceServer` objects: STUN, then TURN over UDP and TCP, then over TLS when it
+     * listens over TLS, with short-lived credentials for the user.
+     * @param user The user the credentials are for.
+     * @returns The ICE servers.
+     * @example
+     * ```typescript
+     * import type {SignalingIceServer, TURNServer} from '@lakutata/webrtc'
+     *
+     * declare const turn: TURNServer
+     * //[{urls: 'stun:203.0.113.10:3478'}, {urls: ['turn:203.0.113.10:3478?transport=udp', …], username, credential}]
+     * const iceServers: SignalingIceServer[] = turn.iceServers('alice')
+     * ```
+     */
+    iceServers(user?: string): SignalingIceServer[];
+}
+/**
+ * Build the options of a {@link TURNServer} component, for the `components` of an application.
+ * @param options Where it listens, the address the clients reach it at, the relay ports, the credentials (all optional).
+ * @returns The component options.
+ * @example
+ * ```typescript
+ * import {Application} from 'lakutata'
+ * import {buildTURNServerOptions} from '@lakutata/webrtc'
+ *
+ * Application.run(() => ({
+ *     id: 'turn.app',
+ *     name: 'TURN',
+ *     components: {
+ *         turn: buildTURNServerOptions({publicAddress: '203.0.113.10', secret: process.env.TURN_SECRET})
+ *     },
+ *     bootstrap: ['turn']
+ * }))
+ * ```
+ */
+export declare function buildTURNServerOptions(options?: TURNServerOptions): ComponentOptions<TURNServerOptions>;

package/dist/cjs/turn/TURNServer.js

@@ -0,0 +1,331 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TURNServer = void 0;
+exports.buildTURNServerOptions = buildTURNServerOptions;
+const node_crypto_1 = require("node:crypto");
+const node_os_1 = require("node:os");
+const core_1 = require("@lakutata/core");
+const di_1 = require("@lakutata/core/decorator/di");
+const turnServer_js_1 = require("../lib/turn/node/turnServer.js");
+const log_js_1 = require("../lib/common/log.js");
+const TURNCredentials_js_1 = require("./TURNCredentials.js");
+const TURNIceServers_js_1 = require("./TURNIceServers.js");
+const TURNWorkers_js_1 = require("./TURNWorkers.js");
+const log = (0, log_js_1.debug)('webrtc/turn');
+/**
+ * How often a server in a cluster tells its load, in milliseconds
+ */
+const ANNOUNCE_INTERVAL = 1000;
+//The first IPv4 address of the host that is not internal
+function defaultPublicAddress() {
+    for (const addresses of Object.values((0, node_os_1.networkInterfaces)())) {
+        const address = addresses?.find((info) => info.family === 'IPv4' && !info.internal);
+        if (address)
+            return address.address;
+    }
+    return '127.0.0.1';
+}
+/**
+ * A STUN and TURN server inside the application (RFC 8489, RFC 8656): over UDP and TCP on port 3478, and over TLS when
+ * given a certificate. The browsers and the other clients use it to find their public address (STUN) and to relay their
+ * traffic when they cannot connect directly (TURN). It authenticates the clients with short-lived credentials made
+ * with its secret ({@link TURNServer.credentials}), as coturn's REST API does, and with the fixed users of its options;
+ * both use the SHA-1 integrity of RFC 5389, which the browsers require.
+ *
+ * Register it with {@link buildTURNServerOptions} and list it in `bootstrap` so that it listens when the application
+ * starts; the `Signaling` component gives its ICE servers and credentials to the members of the rooms. With a
+ * `cluster`, the server tells the other nodes where it is and how many allocations it has, and the signaling of every
+ * node gives the members the least loaded TURN servers of the cluster.
+ * @example
+ * ```typescript
+ * import {Application} from 'lakutata'
+ * import {buildTURNServerOptions, type TURNServer} from '@lakutata/webrtc'
+ *
+ * Application
+ *     .run(() => ({
+ *         id: 'turn.app',
+ *         name: 'TURN',
+ *         components: {
+ *             //UDP and TCP on 3478, the relays on 49160-49200, reached at the public address of the host
+ *             turn: buildTURNServerOptions({publicAddress: '203.0.113.10', relayPortRange: [49160, 49200], secret: process.env.TURN_SECRET})
+ *         },
+ *         bootstrap: ['turn']
+ *     }))
+ *     .onLaunched(async (app: Application): Promise<void> => {
+ *         const turn: TURNServer = await app.getObject<TURNServer>('turn')
+ *         //The ICE servers of a browser, with credentials for the user alice
+ *         console.log(turn.iceServers('alice'))
+ *     })
+ * ```
+ */
+let TURNServer = class TURNServer extends core_1.Component {
+    #server;
+    #workers;
+    #announcer;
+    #clusterObject;
+    #secret;
+    #publicAddress;
+    /**
+     * Start listening.
+     * @protected
+     */
+    async init() {
+        //The servers of a cluster check the credentials made by the other nodes
+        if (this.cluster && !this.secret)
+            throw new core_1.InvalidValueException('A TURN server in a cluster needs the secret shared by the TURN servers of the cluster');
+        this.#secret = this.secret ?? (0, node_crypto_1.randomBytes)(32).toString('base64url');
+        this.#publicAddress = this.publicAddress ?? defaultPublicAddress();
+        const options = {
+            host: this.host,
+            port: this.port,
+            udp: this.udp,
+            tcp: this.tcp,
+            relayAddress: this.#publicAddress,
+            relayBindAddress: this.host,
+            relayPortRange: this.relayPortRange,
+            realm: this.realm,
+            //No limit unless given (the engine has one of 256)
+            maxAllocations: this.maxAllocations ?? Infinity,
+            getPassword: (username) => this.users[username] ?? (0, TURNCredentials_js_1.turnPasswordIfValid)(this.#secret, username)
+        };
+        if (this.tls)
+            options.tls = { cert: this.tls.cert, key: this.tls.key, port: this.tls.port };
+        if (this.workers) {
+            //Checked on every system, the ports shared or not
+            const ranges = this.#relayPortRanges();
+            if (await (0, TURNWorkers_js_1.portsShareable)(this.host))
+                await this.#startWorkers(options, ranges);
+            else
+                log('the ports cannot be shared among threads here (SO_REUSEPORT): the server relays in the main thread, not in %d worker threads', this.workers);
+        }
+        if (!this.#workers) {
+            this.#server = new turnServer_js_1.NodeTurnServer(options);
+            await this.#server.listen();
+        }
+        if (this.cluster) {
+            const cluster = await this.getObject(this.cluster);
+            this.#clusterObject = cluster;
+            this.announce();
+            this.#announcer = setInterval(() => this.announce(), ANNOUNCE_INTERVAL);
+            this.#announcer.unref();
+        }
+    }
+    /**
+     * Leave the cluster, stop listening and close the relays.
+     * @protected
+     */
+    async destroy() {
+        clearInterval(this.#announcer);
+        this.#clusterObject?.announce('turn', undefined);
+        await this.#workers?.stop();
+        await this.#server?.close();
+    }
+    /**
+     * The part of the relay ports of each worker thread
+     * @throws {RangeError} When the range has fewer ports than there are threads.
+     */
+    #relayPortRanges() {
+        return Array.from({ length: this.workers }, (_, index) => {
+            if (!this.relayPortRange)
+                return undefined;
+            const [first, last] = this.relayPortRange;
+            const size = last - first + 1;
+            if (size < this.workers)
+                throw new RangeError(`The relay port range has ${size} ports, fewer than the ${this.workers} worker threads`);
+            return [first + Math.floor(index * size / this.workers), first + Math.floor((index + 1) * size / this.workers) - 1];
+        });
+    }
+    /**
+     * Start the worker threads, each with its part of the relay ports and the credentials (functions stay in the main
+     * thread)
+     * @param options The options of the server of each thread.
+     * @param ranges The part of the relay ports of each.
+     */
+    async #startWorkers(options, ranges) {
+        const { getPassword, ...shared } = options;
+        const allocations = new SharedArrayBuffer(Int32Array.BYTES_PER_ELEMENT * (1 + this.workers));
+        const workers = new TURNWorkers_js_1.TURNWorkers(ranges.map((range, thread) => ({
+            thread: thread,
+            //A Buffer given to a thread arrives as a Uint8Array: the certificate and its key in PEM, as text
+            options: { ...shared, relayPortRange: range, ...this.tls ? { tls: { ...shared.tls, cert: this.tls.cert.toString(), key: this.tls.key.toString() } } : {} },
+            users: this.users,
+            secret: this.#secret,
+            allocations: allocations
+        })));
+        try {
+            await workers.start();
+        }
+        catch (error) {
+            await workers.stop();
+            throw error;
+        }
+        this.#workers = workers;
+        TURNWorkers_js_1.turnWorkers.set(this, workers);
+    }
+    /**
+     * Tell the other nodes of the cluster where the server is and its load (sent with the next heartbeat).
+     * @protected
+     */
+    announce() {
+        this.#clusterObject?.announce('turn', {
+            ...this.location,
+            allocations: this.allocations,
+            maxAllocations: this.maxAllocations,
+            credentialTtl: this.credentialTtl
+        });
+    }
+    /**
+     * The address and the port of STUN and TURN over UDP and TCP, as the clients reach them (the public address).
+     */
+    get address() {
+        return { address: this.#publicAddress, port: (this.#workers ? this.#workers.port : this.#server?.address?.[1]) ?? this.port };
+    }
+    /**
+     * The address and the port of TURN over TLS, as the clients reach them; undefined without TLS.
+     */
+    get tlsAddress() {
+        const port = this.#workers ? this.#workers.tlsPort : this.#server?.tlsAddress?.[1];
+        return port !== undefined ? { address: this.#publicAddress, port: port } : undefined;
+    }
+    /**
+     * Where the clients reach the server: its public address, its ports.
+     */
+    get location() {
+        const { address, port } = this.address;
+        const tls = this.tlsAddress;
+        return { address: address, port: port, udp: this.udp, tcp: this.tcp, ...tls ? { tlsPort: tls.port } : {} };
+    }
+    /**
+     * The allocations in use: the clients relaying their traffic through the server.
+     */
+    get allocations() {
+        return this.#workers ? this.#workers.allocations : this.#server?.protocol.allocationCount ?? 0;
+    }
+    /**
+     * Create short-lived credentials for a user, valid for `credentialTtl` seconds.
+     * @param user The user (the part of the username after the expiry).
+     * @returns The username, the password and their lifetime in seconds.
+     * @example
+     * ```typescript
+     * import type {TURNServer, TURNCredentials} from '@lakutata/webrtc'
+     *
+     * declare const turn: TURNServer
+     * const credentials: TURNCredentials = turn.credentials('alice')
+     * ```
+     */
+    credentials(user = 'anonymous') {
+        return (0, TURNCredentials_js_1.createTURNCredentials)(this.#secret, user, this.credentialTtl);
+    }
+    /**
+     * The ICE servers of a client, as `RTCIceServer` objects: STUN, then TURN over UDP and TCP, then over TLS when it
+     * listens over TLS, with short-lived credentials for the user.
+     * @param user The user the credentials are for.
+     * @returns The ICE servers.
+     * @example
+     * ```typescript
+     * import type {SignalingIceServer, TURNServer} from '@lakutata/webrtc'
+     *
+     * declare const turn: TURNServer
+     * //[{urls: 'stun:203.0.113.10:3478'}, {urls: ['turn:203.0.113.10:3478?transport=udp', …], username, credential}]
+     * const iceServers: SignalingIceServer[] = turn.iceServers('alice')
+     * ```
+     */
+    iceServers(user = 'anonymous') {
+        return (0, TURNIceServers_js_1.iceServersOfTURN)(this.location, this.credentials(user));
+    }
+};
+exports.TURNServer = TURNServer;
+__decorate([
+    (0, di_1.Configurable)(core_1.DTO.String().optional().default('0.0.0.0')),
+    __metadata("design:type", String)
+], TURNServer.prototype, "host", void 0);
+__decorate([
+    (0, di_1.Configurable)(core_1.DTO.Number().port().optional().default(3478)),
+    __metadata("design:type", Number)
+], TURNServer.prototype, "port", void 0);
+__decorate([
+    (0, di_1.Configurable)(core_1.DTO.Boolean().optional().default(true)),
+    __metadata("design:type", Boolean)
+], TURNServer.prototype, "udp", void 0);
+__decorate([
+    (0, di_1.Configurable)(core_1.DTO.Boolean().optional().default(true)),
+    __metadata("design:type", Boolean)
+], TURNServer.prototype, "tcp", void 0);
+__decorate([
+    (0, di_1.Configurable)(core_1.DTO.Object({
+        cert: core_1.DTO.Alternatives(core_1.DTO.String(), core_1.DTO.Binary()).required(),
+        key: core_1.DTO.Alternatives(core_1.DTO.String(), core_1.DTO.Binary()).required(),
+        port: core_1.DTO.Number().port().optional()
+    }).optional()),
+    __metadata("design:type", Object)
+], TURNServer.prototype, "tls", void 0);
+__decorate([
+    (0, di_1.Configurable)(core_1.DTO.String().optional()),
+    __metadata("design:type", String)
+], TURNServer.prototype, "publicAddress", void 0);
+__decorate([
+    (0, di_1.Configurable)(core_1.DTO.Array().items(core_1.DTO.Number().port()).length(2).optional()),
+    __metadata("design:type", Array)
+], TURNServer.prototype, "relayPortRange", void 0);
+__decorate([
+    (0, di_1.Configurable)(core_1.DTO.String().min(1).optional()),
+    __metadata("design:type", String)
+], TURNServer.prototype, "secret", void 0);
+__decorate([
+    (0, di_1.Configurable)(core_1.DTO.Object().pattern(core_1.DTO.String(), core_1.DTO.String()).optional().default({})),
+    __metadata("design:type", Object)
+], TURNServer.prototype, "users", void 0);
+__decorate([
+    (0, di_1.Configurable)(core_1.DTO.String().optional().default('lakutata')),
+    __metadata("design:type", String)
+], TURNServer.prototype, "realm", void 0);
+__decorate([
+    (0, di_1.Configurable)(core_1.DTO.Number().integer().positive().optional().default(86400)),
+    __metadata("design:type", Number)
+], TURNServer.prototype, "credentialTtl", void 0);
+__decorate([
+    (0, di_1.Configurable)(core_1.DTO.Number().integer().positive().optional()),
+    __metadata("design:type", Number)
+], TURNServer.prototype, "maxAllocations", void 0);
+__decorate([
+    (0, di_1.Configurable)(core_1.DTO.Number().integer().min(0).optional().default(0)),
+    __metadata("design:type", Number)
+], TURNServer.prototype, "workers", void 0);
+__decorate([
+    (0, di_1.Configurable)(core_1.DTO.String().optional()),
+    __metadata("design:type", String)
+], TURNServer.prototype, "cluster", void 0);
+exports.TURNServer = TURNServer = __decorate([
+    (0, di_1.Singleton)()
+], TURNServer);
+/**
+ * Build the options of a {@link TURNServer} component, for the `components` of an application.
+ * @param options Where it listens, the address the clients reach it at, the relay ports, the credentials (all optional).
+ * @returns The component options.
+ * @example
+ * ```typescript
+ * import {Application} from 'lakutata'
+ * import {buildTURNServerOptions} from '@lakutata/webrtc'
+ *
+ * Application.run(() => ({
+ *     id: 'turn.app',
+ *     name: 'TURN',
+ *     components: {
+ *         turn: buildTURNServerOptions({publicAddress: '203.0.113.10', secret: process.env.TURN_SECRET})
+ *     },
+ *     bootstrap: ['turn']
+ * }))
+ * ```
+ */
+function buildTURNServerOptions(options = {}) {
+    return { class: TURNServer, ...options };
+}

package/dist/cjs/turn/TURNWorker.d.ts

@@ -0,0 +1,42 @@
+import { type NodeTurnServerOptions } from '../lib/turn/node/turnServer.js';
+/**
+ * What a worker thread of the TURN server is started with
+ */
+export interface TURNWorkerData {
+    readonly thread: number;
+    readonly options: Omit<NodeTurnServerOptions, 'getPassword' | 'allocationGate' | 'reusePort'>;
+    readonly users: Record<string, string>;
+    readonly secret: string;
+    readonly allocations: SharedArrayBuffer;
+}
+/**
+ * The messages of the main thread to a worker thread of the TURN server
+ */
+export type TURNToWorker = {
+    type: 'stop';
+} | {
+    type: 'debug';
+    enabled: boolean;
+};
+/**
+ * The messages of a worker thread of the TURN server to the main thread
+ */
+export type TURNFromWorker = {
+    type: 'ready';
+    port?: number;
+    tlsPort?: number;
+} | {
+    type: 'failed';
+    error: string;
+} | {
+    type: 'stopped';
+} | {
+    type: 'log';
+    namespace: string;
+    message: string;
+};
+/**
+ * Serve TURN in a worker thread: a server whose listeners share their ports with the ones of the other threads (the
+ * system keeps each client on one), the allocations counted with theirs against maxAllocations
+ */
+export declare function runTURNWorker(): void;