@rstreamlabs/tunnels 3.7.0 → 3.8.1

package/dist/{chunk-K6TZT3PB.mjs → chunk-3VBF43NB.mjs}

@@ -243,7 +243,7 @@ var routingPathSchema = z3.object({
   crossRegionRoutingAllowed: z3.boolean(),
   ingress: routingNodeSchema,
   owner: routingNodeSchema,
-  agentTarget: routingNodeSchema
+  anchor: routingNodeSchema
 });
 var routingSchema = z3.discriminatedUnion("decision", [
   z3.object({

package/dist/index.d.mts

@@ -614,7 +614,7 @@ declare const streamSummaryEventSchema: z.ZodObject<{
                     region: z.ZodString;
                     generation: z.ZodOptional<z.ZodString>;
                 }, z.core.$strip>;
-                agentTarget: z.ZodObject<{
+                anchor: z.ZodObject<{
                     engineId: z.ZodString;
                     region: z.ZodString;
                     generation: z.ZodOptional<z.ZodString>;
@@ -2747,7 +2747,7 @@ declare const projectLogEventsSchema: z.ZodObject<{
                     region: z.ZodString;
                     generation: z.ZodOptional<z.ZodString>;
                 }, z.core.$strip>;
-                agentTarget: z.ZodObject<{
+                anchor: z.ZodObject<{
                     engineId: z.ZodString;
                     region: z.ZodString;
                     generation: z.ZodOptional<z.ZodString>;
@@ -4878,7 +4878,7 @@ declare const eventSchema: z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodObject
                     region: z.ZodString;
                     generation: z.ZodOptional<z.ZodString>;
                 }, z.core.$strip>;
-                agentTarget: z.ZodObject<{
+                anchor: z.ZodObject<{
                     engineId: z.ZodString;
                     region: z.ZodString;
                     generation: z.ZodOptional<z.ZodString>;
@@ -6174,7 +6174,7 @@ declare const streamSummarySchema: z.ZodObject<{
                 region: z.ZodString;
                 generation: z.ZodOptional<z.ZodString>;
             }, z.core.$strip>;
-            agentTarget: z.ZodObject<{
+            anchor: z.ZodObject<{
                 engineId: z.ZodString;
                 region: z.ZodString;
                 generation: z.ZodOptional<z.ZodString>;

package/dist/index.d.ts

@@ -614,7 +614,7 @@ declare const streamSummaryEventSchema: z.ZodObject<{
                     region: z.ZodString;
                     generation: z.ZodOptional<z.ZodString>;
                 }, z.core.$strip>;
-                agentTarget: z.ZodObject<{
+                anchor: z.ZodObject<{
                     engineId: z.ZodString;
                     region: z.ZodString;
                     generation: z.ZodOptional<z.ZodString>;
@@ -2747,7 +2747,7 @@ declare const projectLogEventsSchema: z.ZodObject<{
                     region: z.ZodString;
                     generation: z.ZodOptional<z.ZodString>;
                 }, z.core.$strip>;
-                agentTarget: z.ZodObject<{
+                anchor: z.ZodObject<{
                     engineId: z.ZodString;
                     region: z.ZodString;
                     generation: z.ZodOptional<z.ZodString>;
@@ -4878,7 +4878,7 @@ declare const eventSchema: z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodObject
                     region: z.ZodString;
                     generation: z.ZodOptional<z.ZodString>;
                 }, z.core.$strip>;
-                agentTarget: z.ZodObject<{
+                anchor: z.ZodObject<{
                     engineId: z.ZodString;
                     region: z.ZodString;
                     generation: z.ZodOptional<z.ZodString>;
@@ -6174,7 +6174,7 @@ declare const streamSummarySchema: z.ZodObject<{
                 region: z.ZodString;
                 generation: z.ZodOptional<z.ZodString>;
             }, z.core.$strip>;
-            agentTarget: z.ZodObject<{
+            anchor: z.ZodObject<{
                 engineId: z.ZodString;
                 region: z.ZodString;
                 generation: z.ZodOptional<z.ZodString>;

package/dist/index.js

@@ -541,7 +541,7 @@ var routingPathSchema = z3.object({
   crossRegionRoutingAllowed: z3.boolean(),
   ingress: routingNodeSchema,
   owner: routingNodeSchema,
-  agentTarget: routingNodeSchema
+  anchor: routingNodeSchema
 });
 var routingSchema = z3.discriminatedUnion("decision", [
   z3.object({
@@ -1781,6 +1781,7 @@ var defaultTURNPort = 3478;
 var defaultTURNSPort = 5349;
 var defaultTURNCredentialTTLSeconds = 10 * 60;
 var maxTURNCredentialTTLSeconds = 60 * 60;
+var maxTURNKeyringBytes = 8 * 1024;
 var turnTokenClaimsSchema = z8.object({
   exp: z8.number().int().optional(),
   iat: z8.number().int().optional(),
@@ -1909,6 +1910,75 @@ function resolveMode(credentials, mode) {
   }
   return "api";
 }
+async function readBoundedTURNKeyring(reader, chunks = [], size = 0) {
+  const result = await reader.read();
+  if (result.done) {
+    return Buffer.concat(chunks, size).toString("utf8");
+  }
+  const nextSize = size + result.value.byteLength;
+  if (nextSize > maxTURNKeyringBytes) {
+    await reader.cancel();
+    throw new Error("TURN keyring response exceeds the 8 KiB limit.");
+  }
+  return await readBoundedTURNKeyring(
+    reader,
+    [...chunks, result.value],
+    nextSize
+  );
+}
+function parseTURNServerPublicKeyHex(value) {
+  const normalized = value.trim();
+  if (normalized.length === 0 || normalized.length % 2 !== 0 || !/^[0-9a-f]+$/i.test(normalized)) {
+    throw new Error("TURN keyring must contain hexadecimal DER key material.");
+  }
+  try {
+    const key = import_crypto.default.createPublicKey({
+      key: Buffer.from(normalized, "hex"),
+      format: "der",
+      type: "spki"
+    });
+    if (key.asymmetricKeyType !== "ec") {
+      throw new Error("TURN keyring public key must be an EC key.");
+    }
+    return key;
+  } catch (error) {
+    if (error instanceof Error && error.message.startsWith("TURN keyring")) {
+      throw error;
+    }
+    throw new Error("TURN keyring contains an invalid DER public key.", {
+      cause: error
+    });
+  }
+}
+function parseAPPPrivateKey(value) {
+  try {
+    const key = import_crypto.default.createPrivateKey({
+      key: Buffer.from(value, "hex"),
+      format: "der",
+      type: "pkcs8"
+    });
+    if (key.asymmetricKeyType !== "ec") {
+      throw new Error("TURN APP client secret must contain an EC private key.");
+    }
+    return key;
+  } catch (error) {
+    if (error instanceof Error && error.message.startsWith("TURN APP")) {
+      throw error;
+    }
+    throw new Error("TURN APP client secret contains an invalid private key.", {
+      cause: error
+    });
+  }
+}
+function requireMatchingCurve(privateKey, publicKey) {
+  const privateCurve = privateKey.asymmetricKeyDetails?.namedCurve;
+  const publicCurve = publicKey.asymmetricKeyDetails?.namedCurve;
+  if (!privateCurve || privateCurve !== publicCurve) {
+    throw new Error(
+      "TURN APP client and server keys must use the same named curve."
+    );
+  }
+}
 async function loadTURNServerPublicKeyHex(clusterDomain, options) {
   const configuredKey = normalizeOptionalString2(options.keyringBaseUrl);
   const keyringBaseURL = configuredKey ?? normalizeOptionalString2(options.apiUrl) ?? "https://rstream.io";
@@ -1916,11 +1986,19 @@ async function loadTURNServerPublicKeyHex(clusterDomain, options) {
     `/keyrings/turn/${clusterDomain}.spki.der.hex`,
     keyringBaseURL
   );
-  const response = await fetch(url);
+  const response = await fetch(url, { redirect: "manual" });
+  if (response.status >= 300 && response.status < 400) {
+    throw new Error(
+      "TURN keyring request was redirected; redirects are refused."
+    );
+  }
   if (!response.ok) {
-    throw new Error("Failed to load TURN keyring.");
+    throw new Error(`TURN keyring request returned HTTP ${response.status}.`);
+  }
+  if (!response.body) {
+    throw new Error("TURN keyring response body is missing.");
   }
-  return (await response.text()).trim();
+  return (await readBoundedTURNKeyring(response.body.getReader())).trim();
 }
 async function createAPITURNCredentials(options) {
   const projectId = normalizeOptionalString2(options.projectId);
@@ -2019,17 +2097,10 @@ async function createAPPTURNCredentials(options) {
   const ttlSeconds = normalizeTTLSeconds(options.ttlSeconds);
   const exp = normalizeNow(options.now) + ttlSeconds;
   const username = `v1:${exp}:app:${projectEndpoint}:${clientId}`;
-  const clientPrivateKey = import_crypto.default.createPrivateKey({
-    key: Buffer.from(clientSecret, "hex"),
-    format: "der",
-    type: "pkcs8"
-  });
+  const clientPrivateKey = parseAPPPrivateKey(clientSecret);
   const serverPublicKeyHex = normalizeOptionalString2(options.serverPublicKeyHex) ?? await loadTURNServerPublicKeyHex(clusterDomain, options);
-  const serverPublicKey = import_crypto.default.createPublicKey({
-    key: Buffer.from(serverPublicKeyHex, "hex"),
-    format: "der",
-    type: "spki"
-  });
+  const serverPublicKey = parseTURNServerPublicKeyHex(serverPublicKeyHex);
+  requireMatchingCurve(clientPrivateKey, serverPublicKey);
   const sharedSecret = import_crypto.default.diffieHellman({
     privateKey: clientPrivateKey,
     publicKey: serverPublicKey

package/dist/index.mjs

@@ -48,7 +48,7 @@ import {
   webTTYTransportSchema,
   webhookEventsSchema,
   wsEventsSchema
-} from "./chunk-K6TZT3PB.mjs";
+} from "./chunk-3VBF43NB.mjs";
 
 // src/auth-resource.ts
 import { createAuthTokenParamsSchema } from "@rstreamlabs/rstream/auth-token";
@@ -418,6 +418,7 @@ var defaultTURNPort = 3478;
 var defaultTURNSPort = 5349;
 var defaultTURNCredentialTTLSeconds = 10 * 60;
 var maxTURNCredentialTTLSeconds = 60 * 60;
+var maxTURNKeyringBytes = 8 * 1024;
 var turnTokenClaimsSchema = z.object({
   exp: z.number().int().optional(),
   iat: z.number().int().optional(),
@@ -546,6 +547,75 @@ function resolveMode(credentials, mode) {
   }
   return "api";
 }
+async function readBoundedTURNKeyring(reader, chunks = [], size = 0) {
+  const result = await reader.read();
+  if (result.done) {
+    return Buffer.concat(chunks, size).toString("utf8");
+  }
+  const nextSize = size + result.value.byteLength;
+  if (nextSize > maxTURNKeyringBytes) {
+    await reader.cancel();
+    throw new Error("TURN keyring response exceeds the 8 KiB limit.");
+  }
+  return await readBoundedTURNKeyring(
+    reader,
+    [...chunks, result.value],
+    nextSize
+  );
+}
+function parseTURNServerPublicKeyHex(value) {
+  const normalized = value.trim();
+  if (normalized.length === 0 || normalized.length % 2 !== 0 || !/^[0-9a-f]+$/i.test(normalized)) {
+    throw new Error("TURN keyring must contain hexadecimal DER key material.");
+  }
+  try {
+    const key = crypto.createPublicKey({
+      key: Buffer.from(normalized, "hex"),
+      format: "der",
+      type: "spki"
+    });
+    if (key.asymmetricKeyType !== "ec") {
+      throw new Error("TURN keyring public key must be an EC key.");
+    }
+    return key;
+  } catch (error) {
+    if (error instanceof Error && error.message.startsWith("TURN keyring")) {
+      throw error;
+    }
+    throw new Error("TURN keyring contains an invalid DER public key.", {
+      cause: error
+    });
+  }
+}
+function parseAPPPrivateKey(value) {
+  try {
+    const key = crypto.createPrivateKey({
+      key: Buffer.from(value, "hex"),
+      format: "der",
+      type: "pkcs8"
+    });
+    if (key.asymmetricKeyType !== "ec") {
+      throw new Error("TURN APP client secret must contain an EC private key.");
+    }
+    return key;
+  } catch (error) {
+    if (error instanceof Error && error.message.startsWith("TURN APP")) {
+      throw error;
+    }
+    throw new Error("TURN APP client secret contains an invalid private key.", {
+      cause: error
+    });
+  }
+}
+function requireMatchingCurve(privateKey, publicKey) {
+  const privateCurve = privateKey.asymmetricKeyDetails?.namedCurve;
+  const publicCurve = publicKey.asymmetricKeyDetails?.namedCurve;
+  if (!privateCurve || privateCurve !== publicCurve) {
+    throw new Error(
+      "TURN APP client and server keys must use the same named curve."
+    );
+  }
+}
 async function loadTURNServerPublicKeyHex(clusterDomain, options) {
   const configuredKey = normalizeOptionalString2(options.keyringBaseUrl);
   const keyringBaseURL = configuredKey ?? normalizeOptionalString2(options.apiUrl) ?? "https://rstream.io";
@@ -553,11 +623,19 @@ async function loadTURNServerPublicKeyHex(clusterDomain, options) {
     `/keyrings/turn/${clusterDomain}.spki.der.hex`,
     keyringBaseURL
   );
-  const response = await fetch(url);
+  const response = await fetch(url, { redirect: "manual" });
+  if (response.status >= 300 && response.status < 400) {
+    throw new Error(
+      "TURN keyring request was redirected; redirects are refused."
+    );
+  }
   if (!response.ok) {
-    throw new Error("Failed to load TURN keyring.");
+    throw new Error(`TURN keyring request returned HTTP ${response.status}.`);
+  }
+  if (!response.body) {
+    throw new Error("TURN keyring response body is missing.");
   }
-  return (await response.text()).trim();
+  return (await readBoundedTURNKeyring(response.body.getReader())).trim();
 }
 async function createAPITURNCredentials(options) {
   const projectId = normalizeOptionalString2(options.projectId);
@@ -656,17 +734,10 @@ async function createAPPTURNCredentials(options) {
   const ttlSeconds = normalizeTTLSeconds(options.ttlSeconds);
   const exp = normalizeNow(options.now) + ttlSeconds;
   const username = `v1:${exp}:app:${projectEndpoint}:${clientId}`;
-  const clientPrivateKey = crypto.createPrivateKey({
-    key: Buffer.from(clientSecret, "hex"),
-    format: "der",
-    type: "pkcs8"
-  });
+  const clientPrivateKey = parseAPPPrivateKey(clientSecret);
   const serverPublicKeyHex = normalizeOptionalString2(options.serverPublicKeyHex) ?? await loadTURNServerPublicKeyHex(clusterDomain, options);
-  const serverPublicKey = crypto.createPublicKey({
-    key: Buffer.from(serverPublicKeyHex, "hex"),
-    format: "der",
-    type: "spki"
-  });
+  const serverPublicKey = parseTURNServerPublicKeyHex(serverPublicKeyHex);
+  requireMatchingCurve(clientPrivateKey, serverPublicKey);
   const sharedSecret = crypto.diffieHellman({
     privateKey: clientPrivateKey,
     publicKey: serverPublicKey

package/dist/openapi.js

@@ -280,7 +280,7 @@ var routingPathSchema = z3.object({
   crossRegionRoutingAllowed: z3.boolean(),
   ingress: routingNodeSchema,
   owner: routingNodeSchema,
-  agentTarget: routingNodeSchema
+  anchor: routingNodeSchema
 });
 var routingSchema = z3.discriminatedUnion("decision", [
   z3.object({

package/dist/openapi.mjs

@@ -1,7 +1,7 @@
 import {
   engineOpenApiDocument,
   engineOpenApiJson
-} from "./chunk-K6TZT3PB.mjs";
+} from "./chunk-3VBF43NB.mjs";
 export {
   engineOpenApiDocument,
   engineOpenApiJson

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rstreamlabs/tunnels",
-  "version": "3.7.0",
+  "version": "3.8.1",
   "description": "JS/TS SDK for the rstream Engine API and tunnel runtime APIs.",
   "author": "@uartnet <hello@rstream.io>",
   "repository": {
@@ -38,16 +38,16 @@
     "type-check": "tsc --noEmit"
   },
   "devDependencies": {
-    "@turbo/gen": "^2.10.0",
+    "@turbo/gen": "^2.10.6",
     "@types/node": "^26",
-    "eslint": "9.39.4",
+    "eslint": "9.39.5",
     "eslint-config": "*",
     "tsup": "^8.5.1",
-    "typescript": "5.9.3",
+    "typescript": "6.0.3",
     "typescript-config": "*"
   },
   "dependencies": {
-    "@rstreamlabs/rstream": "3.7.0",
+    "@rstreamlabs/rstream": "3.8.0",
     "@types/jsonwebtoken": "^9.0.10",
     "jsonwebtoken": "^9.0.3",
     "zod": "^4.4.3"