@mh-gg/host-config 0.1.1-alpha.20260613T085325975Z

package/package.json

@@ -0,0 +1,20 @@
+{
+  "name": "@mh-gg/host-config",
+  "version": "0.1.1-alpha.20260613T085325975Z",
+  "description": "Host CLI and environment config parsing for matterhorn.",
+  "type": "commonjs",
+  "main": "src/index.cjs",
+  "exports": {
+    ".": "./src/index.cjs"
+  },
+  "dependencies": {
+    "@mh-gg/room-link": "^0.1.1-alpha.20260613T085325975Z"
+  },
+  "engines": {
+    "node": ">=22.12"
+  },
+  "scripts": {
+    "test": "node --test test/*.test.cjs",
+    "coverage": "node --test --experimental-test-coverage --test-coverage-lines=80 --test-coverage-functions=80 --test-coverage-branches=80 --test-coverage-include=src/*.cjs test/*.test.cjs"
+  }
+}

package/src/index.cjs

@@ -0,0 +1,296 @@
+const path = require("node:path");
+const { DEFAULT_APP_URL, slugifyRoom } = require("@mh-gg/room-link");
+
+const PROTOCOL = 1;
+const DEFAULT_RELAY_MAX_EVENTS = 10000;
+const DEFAULT_RELAY_MAX_EVENTS_PER_ROOM = 2500;
+const DEFAULT_RELAY_MAX_BYTES_PER_ROOM = 8 * 1024 * 1024;
+const DEFAULT_RELAY_MAX_EVENTS_PER_PUBKEY_WINDOW = 240;
+const DEFAULT_RELAY_PUBKEY_QUOTA_WINDOW_SECONDS = 10 * 60;
+const DEFAULT_RELAY_MAX_EVENT_BYTES = 8 * 1024;
+const DEFAULT_RELAY_MAX_FUTURE_SECONDS = 10 * 60;
+const DEFAULT_RELAY_ACTIVE_FANOUT = 4;
+const DEFAULT_RELAY_SFU_MAX_PARTICIPANTS = 16;
+const DEFAULT_RELAY_MAX_HOST_IPC_MESSAGE_BYTES = 256 * 1024;
+const DEFAULT_RELAY_MAX_ROOM_MESSAGE_BYTES = 64 * 1024;
+const DEFAULT_RELAY_MAX_MESH_MESSAGE_BYTES = 128 * 1024;
+const DEFAULT_RELAY_MAX_NOSTR_MESSAGE_BYTES = 64 * 1024;
+const DEFAULT_RELAY_MAX_CALL_SIGNAL_BYTES = 32 * 1024;
+const DEFAULT_RELAY_RATE_WINDOW_MS = 10 * 1000;
+const DEFAULT_RELAY_MAX_UNAUTHENTICATED_MESSAGES_PER_WINDOW = 20;
+const DEFAULT_RELAY_MAX_ROOM_MESSAGES_PER_WINDOW = 120;
+const DEFAULT_RELAY_MAX_MESH_MESSAGES_PER_WINDOW = 240;
+const DEFAULT_RELAY_MAX_HOST_IPC_MESSAGES_PER_WINDOW = 240;
+const DEFAULT_RELAY_HEARTBEAT_MS = 1000;
+const DEFAULT_RELAY_HEARTBEAT_TIMEOUT_MS = 2500;
+const DEFAULT_RELAY_FAILOVER_MS = 3500;
+
+function parseRelayPeers(value) {
+  return String(value || "")
+    .split(",")
+    .map((item) => item.trim())
+    .filter(Boolean);
+}
+
+function parseIceServers(value) {
+  return String(value || "")
+    .split(",")
+    .map((item) => item.trim())
+    .filter(Boolean)
+    .map((urls) => ({ urls }));
+}
+
+function parseBool(value) {
+  return ["1", "true", "yes", "on"].includes(String(value || "").trim().toLowerCase());
+}
+
+function defaultHostDataDir() {
+  return path.resolve("host", "data");
+}
+
+function defaultRelayStoragePath(dataDir) {
+  return path.join(dataDir, "relay");
+}
+
+function resolveStoragePath(value, fallback) {
+  const raw = String(value || fallback || "");
+  if (raw === "~") return require("node:os").homedir();
+  if (raw.startsWith("~/") || raw.startsWith("~\\")) {
+    return path.join(require("node:os").homedir(), raw.slice(2));
+  }
+  return path.resolve(raw);
+}
+
+function parseArgs(argv, options = {}) {
+  const env = options.env || process.env;
+  const warn = options.warn || console.warn;
+  const args = {
+    room: env.ROOM || "rooftop-disco",
+    title: env.TITLE || "Rooftop Disco",
+    date: env.DATE || "2026-06-20",
+    time: env.TIME || "8:00 PM",
+    location: env.LOCATION || "Brooklyn rooftop",
+    description: env.DESCRIPTION || "Bring a friend, a snack, and one song for the shared playlist.",
+    appUrl: env.APP_URL || env.HOST_URL || DEFAULT_APP_URL,
+    roomSecret: env.ROOM_SECRET || "",
+    dataDir: env.MATTERHORN_DATA_DIR || options.defaultDataDir || defaultHostDataDir(),
+    theme: env.THEME || "sunset",
+    iceServers: env.ICE_SERVERS || "stun:stun.l.google.com:19302",
+    relayPeers: parseRelayPeers(env.MATTERHORN_RELAY_PEERS),
+    localPeerjs: parseBool(env.MATTERHORN_PEERJS_LOCAL)
+  };
+
+  for (let index = 0; index < argv.length; index += 1) {
+    const token = argv[index];
+    if (!token.startsWith("--")) continue;
+    const key = token.slice(2);
+    const value = argv[index + 1];
+    switch (key) {
+      case "room": args.room = value; index += 1; break;
+      case "title": args.title = value; index += 1; break;
+      case "date": args.date = value; index += 1; break;
+      case "time": args.time = value; index += 1; break;
+      case "location": args.location = value; index += 1; break;
+      case "description": args.description = value; index += 1; break;
+      case "app-url": args.appUrl = value; index += 1; break;
+      case "host-url": args.appUrl = value; index += 1; break;
+      case "secret": args.roomSecret = value; index += 1; break;
+      case "data-dir": args.dataDir = value; index += 1; break;
+      case "ice": args.iceServers = value; index += 1; break;
+      case "relay-peer": args.relayPeers.push(value); index += 1; break;
+      case "local-peerjs":
+      case "peerjs-local":
+        args.localPeerjs = true;
+        break;
+      case "no-local-peerjs":
+        args.localPeerjs = false;
+        break;
+      default:
+        warn(`Unknown option: ${token}`);
+    }
+  }
+
+  args.room = slugifyRoom(args.room);
+  args.dataDir = path.resolve(args.dataDir);
+  return args;
+}
+
+function parseRelayArgs(argv, options = {}) {
+  const env = options.env || process.env;
+  const warn = options.warn || console.warn;
+  const defaultStoragePath = options.defaultStoragePath || defaultRelayStoragePath(options.defaultDataDir || defaultHostDataDir());
+  const args = {
+    ipcHost: env.MATTERHORN_RELAY_IPC_HOST || options.defaultIpcHost || "127.0.0.1",
+    ipcPort: Number(env.MATTERHORN_RELAY_IPC_PORT || options.defaultIpcPort || 42777),
+    storagePath: env.MATTERHORN_RELAY_STORAGE || defaultStoragePath,
+    relayPeerId: env.MATTERHORN_RELAY_PEER_ID || undefined,
+    relayName: env.MATTERHORN_RELAY_NAME || undefined,
+    relayPeers: parseRelayPeers(env.MATTERHORN_RELAY_PEERS),
+    relayRefs: parseRelayPeers(env.MATTERHORN_RELAY_REFS),
+    activeRelayFanout: Number(env.MATTERHORN_RELAY_ACTIVE_FANOUT || DEFAULT_RELAY_ACTIVE_FANOUT),
+    relayHeartbeatMs: Number(env.MATTERHORN_RELAY_HEARTBEAT_MS || DEFAULT_RELAY_HEARTBEAT_MS),
+    relayHeartbeatTimeoutMs: Number(env.MATTERHORN_RELAY_HEARTBEAT_TIMEOUT_MS || DEFAULT_RELAY_HEARTBEAT_TIMEOUT_MS),
+    relayFailoverMs: Number(env.MATTERHORN_RELAY_FAILOVER_MS || DEFAULT_RELAY_FAILOVER_MS),
+    maxEvents: Number(env.MATTERHORN_RELAY_MAX_EVENTS || DEFAULT_RELAY_MAX_EVENTS),
+    maxEventsPerRoom: Number(env.MATTERHORN_RELAY_MAX_EVENTS_PER_ROOM || DEFAULT_RELAY_MAX_EVENTS_PER_ROOM),
+    maxBytesPerRoom: Number(env.MATTERHORN_RELAY_MAX_BYTES_PER_ROOM || DEFAULT_RELAY_MAX_BYTES_PER_ROOM),
+    maxEventsPerPubkeyWindow: Number(env.MATTERHORN_RELAY_MAX_EVENTS_PER_PUBKEY_WINDOW || DEFAULT_RELAY_MAX_EVENTS_PER_PUBKEY_WINDOW),
+    pubkeyQuotaWindowSeconds: Number(env.MATTERHORN_RELAY_PUBKEY_QUOTA_WINDOW_SECONDS || DEFAULT_RELAY_PUBKEY_QUOTA_WINDOW_SECONDS),
+    maxEventBytes: Number(env.MATTERHORN_RELAY_MAX_EVENT_BYTES || DEFAULT_RELAY_MAX_EVENT_BYTES),
+    maxFutureSeconds: Number(env.MATTERHORN_RELAY_MAX_FUTURE_SECONDS || DEFAULT_RELAY_MAX_FUTURE_SECONDS),
+    sfuEnabled: parseBool(env.MATTERHORN_RELAY_SFU),
+    sfuPeerId: env.MATTERHORN_RELAY_SFU_PEER_ID || undefined,
+    sfuMaxParticipants: Number(env.MATTERHORN_RELAY_SFU_MAX_PARTICIPANTS || DEFAULT_RELAY_SFU_MAX_PARTICIPANTS),
+    iceServers: env.ICE_SERVERS || "stun:stun.l.google.com:19302",
+    localPeerjs: parseBool(env.MATTERHORN_PEERJS_LOCAL)
+  };
+
+  for (let index = 0; index < argv.length; index += 1) {
+    const token = argv[index];
+    if (!token.startsWith("--")) continue;
+    const key = token.slice(2);
+    const value = argv[index + 1];
+    switch (key) {
+      case "host":
+      case "ipc-host":
+        args.ipcHost = value;
+        index += 1;
+        break;
+      case "port":
+      case "ipc-port":
+        args.ipcPort = Number(value);
+        index += 1;
+        break;
+      case "storage":
+        args.storagePath = value;
+        index += 1;
+        break;
+      case "relay-peer-id":
+        args.relayPeerId = value;
+        index += 1;
+        break;
+      case "name":
+      case "relay-name":
+        args.relayName = value;
+        index += 1;
+        break;
+      case "relay-peer":
+        args.relayPeers.push(value);
+        index += 1;
+        break;
+      case "addRelay":
+      case "add-relay":
+        args.relayRefs.push(value);
+        index += 1;
+        break;
+      case "active-relay-fanout":
+        args.activeRelayFanout = Number(value);
+        index += 1;
+        break;
+      case "relay-heartbeat-ms":
+        args.relayHeartbeatMs = Number(value);
+        index += 1;
+        break;
+      case "relay-heartbeat-timeout-ms":
+        args.relayHeartbeatTimeoutMs = Number(value);
+        index += 1;
+        break;
+      case "relay-failover-ms":
+        args.relayFailoverMs = Number(value);
+        index += 1;
+        break;
+      case "max-events":
+        args.maxEvents = Number(value);
+        index += 1;
+        break;
+      case "max-events-per-room":
+        args.maxEventsPerRoom = Number(value);
+        index += 1;
+        break;
+      case "max-bytes-per-room":
+        args.maxBytesPerRoom = Number(value);
+        index += 1;
+        break;
+      case "max-events-per-pubkey-window":
+        args.maxEventsPerPubkeyWindow = Number(value);
+        index += 1;
+        break;
+      case "pubkey-quota-window-seconds":
+        args.pubkeyQuotaWindowSeconds = Number(value);
+        index += 1;
+        break;
+      case "max-event-bytes":
+        args.maxEventBytes = Number(value);
+        index += 1;
+        break;
+      case "max-future-seconds":
+        args.maxFutureSeconds = Number(value);
+        index += 1;
+        break;
+      case "sfu":
+        args.sfuEnabled = true;
+        break;
+      case "no-sfu":
+        args.sfuEnabled = false;
+        break;
+      case "sfu-peer-id":
+        args.sfuPeerId = value;
+        index += 1;
+        break;
+      case "sfu-max-participants":
+        args.sfuMaxParticipants = Number(value);
+        index += 1;
+        break;
+      case "ice":
+        args.iceServers = value;
+        index += 1;
+        break;
+      case "local-peerjs":
+      case "peerjs-local":
+        args.localPeerjs = true;
+        break;
+      case "no-local-peerjs":
+        args.localPeerjs = false;
+        break;
+      default:
+        warn(`Unknown relay option: ${token}`);
+    }
+  }
+
+  args.storagePath = resolveStoragePath(args.storagePath, defaultStoragePath);
+  return args;
+}
+
+module.exports = {
+  DEFAULT_RELAY_ACTIVE_FANOUT,
+  DEFAULT_RELAY_FAILOVER_MS,
+  DEFAULT_RELAY_HEARTBEAT_MS,
+  DEFAULT_RELAY_HEARTBEAT_TIMEOUT_MS,
+  DEFAULT_RELAY_MAX_CALL_SIGNAL_BYTES,
+  DEFAULT_RELAY_MAX_BYTES_PER_ROOM,
+  DEFAULT_RELAY_MAX_EVENT_BYTES,
+  DEFAULT_RELAY_MAX_EVENTS_PER_PUBKEY_WINDOW,
+  DEFAULT_RELAY_MAX_EVENTS_PER_ROOM,
+  DEFAULT_RELAY_MAX_EVENTS,
+  DEFAULT_RELAY_MAX_FUTURE_SECONDS,
+  DEFAULT_RELAY_MAX_HOST_IPC_MESSAGE_BYTES,
+  DEFAULT_RELAY_MAX_HOST_IPC_MESSAGES_PER_WINDOW,
+  DEFAULT_RELAY_MAX_MESH_MESSAGE_BYTES,
+  DEFAULT_RELAY_MAX_MESH_MESSAGES_PER_WINDOW,
+  DEFAULT_RELAY_MAX_NOSTR_MESSAGE_BYTES,
+  DEFAULT_RELAY_MAX_ROOM_MESSAGE_BYTES,
+  DEFAULT_RELAY_MAX_ROOM_MESSAGES_PER_WINDOW,
+  DEFAULT_RELAY_MAX_UNAUTHENTICATED_MESSAGES_PER_WINDOW,
+  DEFAULT_RELAY_PUBKEY_QUOTA_WINDOW_SECONDS,
+  DEFAULT_RELAY_RATE_WINDOW_MS,
+  DEFAULT_RELAY_SFU_MAX_PARTICIPANTS,
+  PROTOCOL,
+  defaultHostDataDir,
+  defaultRelayStoragePath,
+  parseArgs,
+  parseBool,
+  parseIceServers,
+  parseRelayArgs,
+  parseRelayPeers,
+  resolveStoragePath
+};

package/test/host-config.test.cjs

@@ -0,0 +1,225 @@
+const assert = require("node:assert/strict");
+const os = require("node:os");
+const path = require("node:path");
+const test = require("node:test");
+const {
+  DEFAULT_RELAY_MAX_CALL_SIGNAL_BYTES,
+  DEFAULT_RELAY_MAX_BYTES_PER_ROOM,
+  DEFAULT_RELAY_MAX_EVENT_BYTES,
+  DEFAULT_RELAY_MAX_EVENTS_PER_PUBKEY_WINDOW,
+  DEFAULT_RELAY_MAX_EVENTS_PER_ROOM,
+  DEFAULT_RELAY_MAX_FUTURE_SECONDS,
+  DEFAULT_RELAY_MAX_HOST_IPC_MESSAGE_BYTES,
+  DEFAULT_RELAY_MAX_MESH_MESSAGE_BYTES,
+  DEFAULT_RELAY_MAX_NOSTR_MESSAGE_BYTES,
+  DEFAULT_RELAY_MAX_ROOM_MESSAGE_BYTES,
+  DEFAULT_RELAY_MAX_UNAUTHENTICATED_MESSAGES_PER_WINDOW,
+  DEFAULT_RELAY_PUBKEY_QUOTA_WINDOW_SECONDS,
+  DEFAULT_RELAY_RATE_WINDOW_MS,
+  parseArgs,
+  parseIceServers,
+  parseRelayArgs,
+  parseRelayPeers
+} = require("..");
+
+test("parses host args with normalized room and data dir", () => {
+  const warnings = [];
+  const args = parseArgs([
+    "--room", " Rooftop Party!! ",
+    "--data-dir", path.join(os.tmpdir(), "matterhorn-data"),
+    "--relay-peer", "peerjs:first",
+    "--relay-peer", "peerjs:second",
+    "--secret", "cli-secret",
+    "--unknown", "value"
+  ], {
+    env: {},
+    warn: (message) => warnings.push(message)
+  });
+
+  assert.equal(args.room, "rooftop-party");
+  assert.equal(args.roomSecret, "cli-secret");
+  assert.deepEqual(args.relayPeers, ["peerjs:first", "peerjs:second"]);
+  assert.equal(args.dataDir, path.resolve(os.tmpdir(), "matterhorn-data"));
+  assert.deepEqual(warnings, ["Unknown option: --unknown"]);
+});
+
+test("reads environment defaults and resolves the configured default data dir", () => {
+  const args = parseArgs([], {
+    defaultDataDir: path.join(os.tmpdir(), "default-matterhorn-data"),
+    env: {
+      ROOM: "env-room",
+      MATTERHORN_RELAY_PEERS: " peerjs:a, ,peerjs:b ",
+      ROOM_SECRET: "env-secret"
+    }
+  });
+
+  assert.equal(args.room, "env-room");
+  assert.equal(args.roomSecret, "env-secret");
+  assert.deepEqual(args.relayPeers, ["peerjs:a", "peerjs:b"]);
+  assert.equal(args.dataDir, path.resolve(os.tmpdir(), "default-matterhorn-data"));
+});
+
+test("command line values override env defaults", () => {
+  const args = parseArgs([
+    "ignored-position",
+    "--title", "CLI Title",
+    "--date", "2026-07-01",
+    "--time", "9:00 PM",
+    "--location", "CLI Venue",
+    "--description", "CLI Description",
+    "--app-url", "https://app-url.test/",
+    "--host-url", "https://example.test/",
+    "--ice", "stun:test"
+  ], {
+    env: {
+      APP_URL: "https://env.test/",
+      ICE_SERVERS: "stun:env"
+    }
+  });
+
+  assert.equal(args.title, "CLI Title");
+  assert.equal(args.date, "2026-07-01");
+  assert.equal(args.time, "9:00 PM");
+  assert.equal(args.location, "CLI Venue");
+  assert.equal(args.description, "CLI Description");
+  assert.equal(args.appUrl, "https://example.test/");
+  assert.equal(args.iceServers, "stun:test");
+});
+
+test("parseRelayPeers trims empty entries", () => {
+  assert.deepEqual(parseRelayPeers(" peerjs:a, ,peerjs:b "), ["peerjs:a", "peerjs:b"]);
+});
+
+test("parseRelayPeers preserves endpoint-aware PeerJS relay addresses", () => {
+  assert.deepEqual(
+    parseRelayPeers(" peerjs:a-relay@ws://127.0.0.1:9000/peerjs, peerjs:b-relay@wss://peer.yage.games:443/ "),
+    ["peerjs:a-relay@ws://127.0.0.1:9000/peerjs", "peerjs:b-relay@wss://peer.yage.games:443/"]
+  );
+});
+
+test("parses relay args with SFU and storage settings", () => {
+  const warnings = [];
+  const args = parseRelayArgs([
+    "--host", "0.0.0.0",
+    "--port", "1234",
+    "--storage", "~/.matterhorn/relay",
+    "--name", "relay-a",
+    "--relay-peer-id", "matterhorn-room",
+    "--relay-peer", "peerjs:relay-a",
+    "--addRelay", "matterhorn-relay:token",
+    "--add-relay", "peerjs:relay-b",
+    "--active-relay-fanout", "6",
+    "--max-events", "25",
+    "--max-events-per-room", "10",
+    "--max-bytes-per-room", "40960",
+    "--max-events-per-pubkey-window", "7",
+    "--pubkey-quota-window-seconds", "30",
+    "--max-event-bytes", "4096",
+    "--max-future-seconds", "120",
+    "--sfu",
+    "--sfu-peer-id", "matterhorn-room-sfu",
+    "--sfu-max-participants", "24",
+    "--ice", "stun:test",
+    "--unknown"
+  ], {
+    env: {},
+    defaultIpcHost: "127.0.0.1",
+    defaultIpcPort: 42777,
+    defaultStoragePath: path.join(os.tmpdir(), "relay-default"),
+    warn: (message) => warnings.push(message)
+  });
+
+  assert.equal(args.ipcHost, "0.0.0.0");
+  assert.equal(args.ipcPort, 1234);
+  assert.equal(args.storagePath, path.join(os.homedir(), ".matterhorn", "relay"));
+  assert.equal(args.relayName, "relay-a");
+  assert.equal(args.relayPeerId, "matterhorn-room");
+  assert.deepEqual(args.relayPeers, ["peerjs:relay-a"]);
+  assert.deepEqual(args.relayRefs, ["matterhorn-relay:token", "peerjs:relay-b"]);
+  assert.equal(args.activeRelayFanout, 6);
+  assert.equal(args.maxEvents, 25);
+  assert.equal(args.maxEventsPerRoom, 10);
+  assert.equal(args.maxBytesPerRoom, 40960);
+  assert.equal(args.maxEventsPerPubkeyWindow, 7);
+  assert.equal(args.pubkeyQuotaWindowSeconds, 30);
+  assert.equal(args.maxEventBytes, 4096);
+  assert.equal(args.maxFutureSeconds, 120);
+  assert.equal(args.sfuEnabled, true);
+  assert.equal(args.sfuPeerId, "matterhorn-room-sfu");
+  assert.equal(args.sfuMaxParticipants, 24);
+  assert.equal(args.iceServers, "stun:test");
+  assert.deepEqual(warnings, ["Unknown relay option: --unknown"]);
+});
+
+test("relay args read environment defaults and no-sfu override", () => {
+  const args = parseRelayArgs(["--no-sfu"], {
+    defaultStoragePath: path.join(os.tmpdir(), "relay-default"),
+    env: {
+      MATTERHORN_RELAY_IPC_HOST: "127.0.0.2",
+      MATTERHORN_RELAY_IPC_PORT: "5555",
+      MATTERHORN_RELAY_STORAGE: "relay-store",
+      MATTERHORN_RELAY_NAME: "relay-name",
+      MATTERHORN_RELAY_PEER_ID: "relay-peer",
+      MATTERHORN_RELAY_PEERS: " peerjs:a, ,peerjs:b ",
+      MATTERHORN_RELAY_REFS: " relay-a, ,matterhorn-relay:token ",
+      MATTERHORN_RELAY_ACTIVE_FANOUT: "5",
+      MATTERHORN_RELAY_MAX_EVENTS: "50",
+      MATTERHORN_RELAY_MAX_EVENTS_PER_ROOM: "20",
+      MATTERHORN_RELAY_MAX_BYTES_PER_ROOM: "81920",
+      MATTERHORN_RELAY_MAX_EVENTS_PER_PUBKEY_WINDOW: "9",
+      MATTERHORN_RELAY_PUBKEY_QUOTA_WINDOW_SECONDS: "45",
+      MATTERHORN_RELAY_MAX_EVENT_BYTES: "2048",
+      MATTERHORN_RELAY_MAX_FUTURE_SECONDS: "30",
+      MATTERHORN_RELAY_SFU: "1",
+      MATTERHORN_RELAY_SFU_PEER_ID: "relay-sfu",
+      MATTERHORN_RELAY_SFU_MAX_PARTICIPANTS: "12",
+      ICE_SERVERS: "stun:env"
+    }
+  });
+
+  assert.equal(args.ipcHost, "127.0.0.2");
+  assert.equal(args.ipcPort, 5555);
+  assert.equal(args.storagePath, path.resolve("relay-store"));
+  assert.equal(args.relayName, "relay-name");
+  assert.equal(args.relayPeerId, "relay-peer");
+  assert.deepEqual(args.relayPeers, ["peerjs:a", "peerjs:b"]);
+  assert.deepEqual(args.relayRefs, ["relay-a", "matterhorn-relay:token"]);
+  assert.equal(args.activeRelayFanout, 5);
+  assert.equal(args.maxEvents, 50);
+  assert.equal(args.maxEventsPerRoom, 20);
+  assert.equal(args.maxBytesPerRoom, 81920);
+  assert.equal(args.maxEventsPerPubkeyWindow, 9);
+  assert.equal(args.pubkeyQuotaWindowSeconds, 45);
+  assert.equal(args.maxEventBytes, 2048);
+  assert.equal(args.maxFutureSeconds, 30);
+  assert.equal(args.sfuEnabled, false);
+  assert.equal(args.sfuPeerId, "relay-sfu");
+  assert.equal(args.sfuMaxParticipants, 12);
+});
+
+test("relay security bounds have explicit defaults", () => {
+  const args = parseRelayArgs([], { env: {}, defaultStoragePath: path.join(os.tmpdir(), "relay-default") });
+  assert.equal(DEFAULT_RELAY_MAX_EVENTS_PER_ROOM, 2500);
+  assert.equal(DEFAULT_RELAY_MAX_BYTES_PER_ROOM, 8 * 1024 * 1024);
+  assert.equal(DEFAULT_RELAY_MAX_EVENTS_PER_PUBKEY_WINDOW, 240);
+  assert.equal(DEFAULT_RELAY_PUBKEY_QUOTA_WINDOW_SECONDS, 10 * 60);
+  assert.equal(DEFAULT_RELAY_MAX_EVENT_BYTES, 8 * 1024);
+  assert.equal(DEFAULT_RELAY_MAX_FUTURE_SECONDS, 10 * 60);
+  assert.equal(DEFAULT_RELAY_MAX_HOST_IPC_MESSAGE_BYTES, 256 * 1024);
+  assert.equal(DEFAULT_RELAY_MAX_ROOM_MESSAGE_BYTES, 64 * 1024);
+  assert.equal(DEFAULT_RELAY_MAX_MESH_MESSAGE_BYTES, 128 * 1024);
+  assert.equal(DEFAULT_RELAY_MAX_NOSTR_MESSAGE_BYTES, 64 * 1024);
+  assert.equal(DEFAULT_RELAY_MAX_CALL_SIGNAL_BYTES, 32 * 1024);
+  assert.equal(DEFAULT_RELAY_RATE_WINDOW_MS, 10 * 1000);
+  assert.equal(DEFAULT_RELAY_MAX_UNAUTHENTICATED_MESSAGES_PER_WINDOW, 20);
+  assert.equal(args.maxEventsPerRoom, DEFAULT_RELAY_MAX_EVENTS_PER_ROOM);
+  assert.equal(args.maxBytesPerRoom, DEFAULT_RELAY_MAX_BYTES_PER_ROOM);
+  assert.equal(args.maxEventsPerPubkeyWindow, DEFAULT_RELAY_MAX_EVENTS_PER_PUBKEY_WINDOW);
+  assert.equal(args.pubkeyQuotaWindowSeconds, DEFAULT_RELAY_PUBKEY_QUOTA_WINDOW_SECONDS);
+  assert.equal(args.maxEventBytes, DEFAULT_RELAY_MAX_EVENT_BYTES);
+  assert.equal(args.maxFutureSeconds, DEFAULT_RELAY_MAX_FUTURE_SECONDS);
+});
+
+test("parseIceServers returns RTC server objects", () => {
+  assert.deepEqual(parseIceServers(" stun:a, ,turn:b "), [{ urls: "stun:a" }, { urls: "turn:b" }]);
+});