@rstreamlabs/tunnels 3.8.1 → 3.8.2

package/dist/index.js

@@ -1766,9 +1766,9 @@ var RstreamTunnelsResource = class {
 };
 
 // src/tunnels.ts
-var import_rstream11 = require("@rstreamlabs/rstream");
 var import_rstream12 = require("@rstreamlabs/rstream");
 var import_rstream13 = require("@rstreamlabs/rstream");
+var import_rstream14 = require("@rstreamlabs/rstream");
 
 // src/turn.ts
 var import_rstream8 = require("@rstreamlabs/rstream");
@@ -1831,14 +1831,14 @@ function normalizeTURNPort(port) {
 function normalizeTURNSPort(port) {
   return normalizePort(port, defaultTURNSPort, "TURNS port");
 }
-function createTURNURLs(clusterDomain, turnPort, turnsPort) {
+function createTURNURLs(turnDomain, turnPort, turnsPort) {
   const normalizedTURNPort = normalizeTURNPort(turnPort);
   const normalizedTURNSPort = normalizeTURNSPort(turnsPort);
   return [
-    `turn:${clusterDomain}:${normalizedTURNPort}?transport=udp`,
-    `turn:${clusterDomain}:${normalizedTURNPort}?transport=tcp`,
-    `turns:${clusterDomain}:${normalizedTURNSPort}?transport=udp`,
-    `turns:${clusterDomain}:${normalizedTURNSPort}?transport=tcp`
+    `turn:${turnDomain}:${normalizedTURNPort}?transport=udp`,
+    `turn:${turnDomain}:${normalizedTURNPort}?transport=tcp`,
+    `turns:${turnDomain}:${normalizedTURNSPort}?transport=udp`,
+    `turns:${turnDomain}:${normalizedTURNSPort}?transport=tcp`
   ];
 }
 function parseTURNTokenClaims(token) {
@@ -2030,9 +2030,14 @@ async function createAPITURNCredentials(options) {
   );
 }
 function createPATTURNCredentials(options) {
-  const clusterDomain = normalizeClusterDomain(options.clusterDomain);
-  if (!clusterDomain) {
-    throw new Error("Cluster domain is required for TURN PAT mode.");
+  const legacyDomain = normalizeClusterDomain(options.clusterDomain);
+  const turnDomain = normalizeClusterDomain(options.turnDomain) ?? legacyDomain;
+  const turnRealm = normalizeClusterDomain(options.turnRealm) ?? legacyDomain;
+  if (!turnDomain) {
+    throw new Error("TURN domain is required for TURN PAT mode.");
+  }
+  if (!turnRealm) {
+    throw new Error("TURN realm is required for TURN PAT mode.");
   }
   const projectEndpoint = normalizeOptionalString2(options.projectEndpoint);
   if (!projectEndpoint) {
@@ -2046,12 +2051,19 @@ function createPATTURNCredentials(options) {
   if (claims.type !== "pat") {
     throw new Error("TURN PAT mode requires a PAT token.");
   }
-  const tokenEndpoint = normalizeOptionalString2(options.tokenEndpoint);
+  const claimsTokenEndpoint = normalizeOptionalString2(
+    claims.token_endpoint ?? claims.tokendpoint
+  );
+  const configuredTokenEndpoint = normalizeOptionalString2(
+    options.tokenEndpoint
+  );
+  const tokenEndpoint = configuredTokenEndpoint ?? claimsTokenEndpoint;
   if (!tokenEndpoint) {
-    throw new Error("Token endpoint is required for TURN PAT mode.");
+    throw new Error(
+      "TURN PAT mode requires a PAT token carrying a token endpoint."
+    );
   }
-  const claimsTokenEndpoint = claims.token_endpoint ?? claims.tokendpoint;
-  if (claimsTokenEndpoint !== void 0 && claimsTokenEndpoint !== tokenEndpoint) {
+  if (configuredTokenEndpoint !== void 0 && claimsTokenEndpoint !== void 0 && claimsTokenEndpoint !== configuredTokenEndpoint) {
     throw new Error("Token endpoint does not match the PAT token.");
   }
   const now = normalizeNow(options.now);
@@ -2064,7 +2076,7 @@ function createPATTURNCredentials(options) {
     import_crypto.default.hkdfSync(
       "sha256",
       tokenHash,
-      Buffer.from(clusterDomain, "utf8"),
+      Buffer.from(turnRealm, "utf8"),
       Buffer.from("turn-pat-v1", "utf8"),
       32
     )
@@ -2073,14 +2085,19 @@ function createPATTURNCredentials(options) {
   return import_turn.turnCredentialsSchema.parse({
     credential,
     ttl,
-    urls: createTURNURLs(clusterDomain, options.turnPort, options.turnsPort),
+    urls: createTURNURLs(turnDomain, options.turnPort, options.turnsPort),
     username
   });
 }
 async function createAPPTURNCredentials(options) {
-  const clusterDomain = normalizeClusterDomain(options.clusterDomain);
-  if (!clusterDomain) {
-    throw new Error("Cluster domain is required for TURN APP mode.");
+  const legacyDomain = normalizeClusterDomain(options.clusterDomain);
+  const turnDomain = normalizeClusterDomain(options.turnDomain) ?? legacyDomain;
+  const turnRealm = normalizeClusterDomain(options.turnRealm) ?? legacyDomain;
+  if (!turnDomain) {
+    throw new Error("TURN domain is required for TURN APP mode.");
+  }
+  if (!turnRealm) {
+    throw new Error("TURN realm is required for TURN APP mode.");
   }
   const projectEndpoint = normalizeOptionalString2(options.projectEndpoint);
   if (!projectEndpoint) {
@@ -2098,7 +2115,7 @@ async function createAPPTURNCredentials(options) {
   const exp = normalizeNow(options.now) + ttlSeconds;
   const username = `v1:${exp}:app:${projectEndpoint}:${clientId}`;
   const clientPrivateKey = parseAPPPrivateKey(clientSecret);
-  const serverPublicKeyHex = normalizeOptionalString2(options.serverPublicKeyHex) ?? await loadTURNServerPublicKeyHex(clusterDomain, options);
+  const serverPublicKeyHex = normalizeOptionalString2(options.serverPublicKeyHex) ?? await loadTURNServerPublicKeyHex(turnRealm, options);
   const serverPublicKey = parseTURNServerPublicKeyHex(serverPublicKeyHex);
   requireMatchingCurve(clientPrivateKey, serverPublicKey);
   const sharedSecret = import_crypto.default.diffieHellman({
@@ -2109,7 +2126,7 @@ async function createAPPTURNCredentials(options) {
     import_crypto.default.hkdfSync(
       "sha256",
       sharedSecret,
-      Buffer.from(clusterDomain, "utf8"),
+      Buffer.from(turnRealm, "utf8"),
       Buffer.from("turn-app-v1", "utf8"),
       32
     )
@@ -2118,7 +2135,7 @@ async function createAPPTURNCredentials(options) {
   return import_turn.turnCredentialsSchema.parse({
     credential,
     ttl: ttlSeconds,
-    urls: createTURNURLs(clusterDomain, options.turnPort, options.turnsPort),
+    urls: createTURNURLs(turnDomain, options.turnPort, options.turnsPort),
     username
   });
 }
@@ -2141,28 +2158,31 @@ async function createTURNCredentials(options) {
       ttlSeconds: options.ttlSeconds
     });
   }
-  const clusterDomain = normalizeClusterDomain(options.clusterDomain) ?? (projectEndpoint && options.engine ? deriveClusterDomainFromEngine(projectEndpoint, options.engine) : void 0);
+  const legacyDomain = normalizeClusterDomain(options.clusterDomain);
+  const turnDomain = normalizeClusterDomain(options.turnDomain) ?? legacyDomain ?? (projectEndpoint && options.engine ? deriveClusterDomainFromEngine(projectEndpoint, options.engine) : void 0);
+  const turnRealm = normalizeClusterDomain(options.turnRealm) ?? legacyDomain;
   if (mode === "pat") {
     if (!(0, import_rstream9.isTokenCredentials)(credentials)) {
       throw new Error("A PAT token is required for TURN PAT mode.");
     }
     return createPATTURNCredentials({
-      clusterDomain: requireOption(
-        clusterDomain,
-        "Cluster domain is required for TURN PAT mode."
-      ),
       now: options.now,
       projectEndpoint: requireOption(
         projectEndpoint,
         "Project endpoint is required for TURN PAT mode."
       ),
       token: credentials.token,
-      tokenEndpoint: requireOption(
-        normalizeOptionalString2(options.tokenEndpoint),
-        "Token endpoint is required for TURN PAT mode."
-      ),
+      tokenEndpoint: options.tokenEndpoint,
       ttlSeconds: options.ttlSeconds,
+      turnDomain: requireOption(
+        turnDomain,
+        "TURN domain is required for TURN PAT mode."
+      ),
       turnPort: options.turnPort,
+      turnRealm: requireOption(
+        turnRealm,
+        "TURN realm is required for TURN PAT mode."
+      ),
       turnsPort: options.turnsPort
     });
   }
@@ -2173,10 +2193,6 @@ async function createTURNCredentials(options) {
     apiUrl: options.apiUrl,
     clientId: credentials.clientId,
     clientSecret: credentials.clientSecret,
-    clusterDomain: requireOption(
-      clusterDomain,
-      "Cluster domain is required for TURN APP mode."
-    ),
     keyringBaseUrl: options.keyringBaseUrl,
     now: options.now,
     projectEndpoint: requireOption(
@@ -2185,24 +2201,36 @@ async function createTURNCredentials(options) {
     ),
     serverPublicKeyHex: options.serverPublicKeyHex,
     ttlSeconds: options.ttlSeconds,
+    turnDomain: requireOption(
+      turnDomain,
+      "TURN domain is required for TURN APP mode."
+    ),
     turnPort: options.turnPort,
+    turnRealm: requireOption(
+      turnRealm,
+      "TURN realm is required for TURN APP mode."
+    ),
     turnsPort: options.turnsPort
   });
 }
 
 // src/turn-resource.ts
+var import_rstream11 = require("@rstreamlabs/rstream");
 var RstreamTURNResource = class {
   client;
   constructor(client) {
     this.client = client;
   }
   async createCredentials(options = {}) {
-    const engine = options.engine ?? (options.clusterDomain === void 0 ? await this.client.getEngine().catch(() => void 0) : void 0);
+    const credentials = options.credentials ?? this.client.credentials;
+    const localMode = options.mode === "app" || options.mode === "pat" || options.mode === void 0 && (0, import_rstream11.isClientCredentials)(credentials);
+    const target = localMode && (options.turnDomain === void 0 || options.turnRealm === void 0) && options.clusterDomain === void 0 ? await this.client.getTURNTarget() : void 0;
+    const engine = options.engine ?? (options.clusterDomain === void 0 && options.turnDomain === void 0 && target === void 0 ? await this.client.getEngine().catch(() => void 0) : void 0);
     return await createTURNCredentials({
       apiUrl: options.apiUrl ?? this.client.apiUrl,
       clusterDomain: options.clusterDomain,
       controlPlaneCredentials: options.controlPlaneCredentials ?? this.client.controlPlaneCredentials,
-      credentials: options.credentials ?? this.client.credentials,
+      credentials,
       engine,
       keyringBaseUrl: options.keyringBaseUrl,
       mode: options.mode,
@@ -2212,8 +2240,10 @@ var RstreamTURNResource = class {
       serverPublicKeyHex: options.serverPublicKeyHex,
       tokenEndpoint: options.tokenEndpoint,
       ttlSeconds: options.ttlSeconds,
-      turnPort: options.turnPort,
-      turnsPort: options.turnsPort
+      turnDomain: options.turnDomain ?? target?.turnDomain,
+      turnPort: options.turnPort ?? target?.turnPort,
+      turnRealm: options.turnRealm ?? target?.turnRealm,
+      turnsPort: options.turnsPort ?? target?.turnsPort
     });
   }
 };
@@ -2394,7 +2424,7 @@ var RstreamTunnelsClient = class {
       this.config?.projectEndpoint
     );
     if (region !== void 0) {
-      if (normalizeOptionalString3(this.config?.engine) !== void 0 || (0, import_rstream13.readEnvironment)().engine !== void 0) {
+      if (normalizeOptionalString3(this.config?.engine) !== void 0 || (0, import_rstream14.readEnvironment)().engine !== void 0) {
         throw new Error(
           "Region selection cannot be combined with an explicit engine override."
         );
@@ -2406,17 +2436,17 @@ var RstreamTunnelsClient = class {
       }
       const project = await this.getManagedProject();
       if (project !== void 0) {
-        const engine = (0, import_rstream11.getTunnelsProjectEngine)(project, region);
+        const engine = (0, import_rstream12.getTunnelsProjectEngine)(project, region);
         if (engine) return normalizeEngineAddress(engine);
       }
       throw new Error(
         "Failed to resolve the selected regional engine from the managed tunnels project."
       );
     }
-    if (projectEndpoint !== void 0 && normalizeOptionalString3(this.config?.engine) === void 0 && (0, import_rstream13.readEnvironment)().engine === void 0) {
+    if (projectEndpoint !== void 0 && normalizeOptionalString3(this.config?.engine) === void 0 && (0, import_rstream14.readEnvironment)().engine === void 0) {
       const project = await this.getManagedProject();
       if (project !== void 0) {
-        const engine = (0, import_rstream11.getTunnelsProjectEngine)(project);
+        const engine = (0, import_rstream12.getTunnelsProjectEngine)(project);
         if (engine) {
           return normalizeEngineAddress(engine);
         }
@@ -2435,6 +2465,27 @@ var RstreamTunnelsClient = class {
       region: this.config?.region
     });
   }
+  async getTURNTarget() {
+    const project = await this.getManagedProject();
+    if (project === void 0) {
+      throw new Error(
+        "Managed project endpoint is required to resolve the TURN target."
+      );
+    }
+    const turnDomain = project.turnDomain?.trim() || project.domain.trim();
+    const turnRealm = project.turnRealm?.trim();
+    if (!turnRealm) {
+      throw new Error(
+        "Managed project metadata does not expose the TURN realm; use API credential mode or provide turnRealm explicitly."
+      );
+    }
+    return {
+      turnDomain,
+      turnPort: project.turnPort,
+      turnRealm,
+      turnsPort: project.turnsPort
+    };
+  }
   async getManagedProject() {
     const projectEndpoint = normalizeOptionalString3(
       this.config?.projectEndpoint
@@ -2511,7 +2562,7 @@ var RstreamTunnelsClient = class {
     if (!credentials) {
       return void 0;
     }
-    if (!(0, import_rstream12.isClientCredentials)(credentials)) {
+    if (!(0, import_rstream13.isClientCredentials)(credentials)) {
       return credentials.token;
     }
     const tokenParams = await this.getEngineAuthTokenParams();

package/dist/index.mjs

@@ -404,7 +404,7 @@ var RstreamTunnelsResource = class {
 
 // src/tunnels.ts
 import { getTunnelsProjectEngine as getTunnelsProjectEngine2 } from "@rstreamlabs/rstream";
-import { isClientCredentials as isClientCredentials3 } from "@rstreamlabs/rstream";
+import { isClientCredentials as isClientCredentials4 } from "@rstreamlabs/rstream";
 import { readEnvironment as readEnvironment2 } from "@rstreamlabs/rstream";
 
 // src/turn.ts
@@ -468,14 +468,14 @@ function normalizeTURNPort(port) {
 function normalizeTURNSPort(port) {
   return normalizePort(port, defaultTURNSPort, "TURNS port");
 }
-function createTURNURLs(clusterDomain, turnPort, turnsPort) {
+function createTURNURLs(turnDomain, turnPort, turnsPort) {
   const normalizedTURNPort = normalizeTURNPort(turnPort);
   const normalizedTURNSPort = normalizeTURNSPort(turnsPort);
   return [
-    `turn:${clusterDomain}:${normalizedTURNPort}?transport=udp`,
-    `turn:${clusterDomain}:${normalizedTURNPort}?transport=tcp`,
-    `turns:${clusterDomain}:${normalizedTURNSPort}?transport=udp`,
-    `turns:${clusterDomain}:${normalizedTURNSPort}?transport=tcp`
+    `turn:${turnDomain}:${normalizedTURNPort}?transport=udp`,
+    `turn:${turnDomain}:${normalizedTURNPort}?transport=tcp`,
+    `turns:${turnDomain}:${normalizedTURNSPort}?transport=udp`,
+    `turns:${turnDomain}:${normalizedTURNSPort}?transport=tcp`
   ];
 }
 function parseTURNTokenClaims(token) {
@@ -667,9 +667,14 @@ async function createAPITURNCredentials(options) {
   );
 }
 function createPATTURNCredentials(options) {
-  const clusterDomain = normalizeClusterDomain(options.clusterDomain);
-  if (!clusterDomain) {
-    throw new Error("Cluster domain is required for TURN PAT mode.");
+  const legacyDomain = normalizeClusterDomain(options.clusterDomain);
+  const turnDomain = normalizeClusterDomain(options.turnDomain) ?? legacyDomain;
+  const turnRealm = normalizeClusterDomain(options.turnRealm) ?? legacyDomain;
+  if (!turnDomain) {
+    throw new Error("TURN domain is required for TURN PAT mode.");
+  }
+  if (!turnRealm) {
+    throw new Error("TURN realm is required for TURN PAT mode.");
   }
   const projectEndpoint = normalizeOptionalString2(options.projectEndpoint);
   if (!projectEndpoint) {
@@ -683,12 +688,19 @@ function createPATTURNCredentials(options) {
   if (claims.type !== "pat") {
     throw new Error("TURN PAT mode requires a PAT token.");
   }
-  const tokenEndpoint = normalizeOptionalString2(options.tokenEndpoint);
+  const claimsTokenEndpoint = normalizeOptionalString2(
+    claims.token_endpoint ?? claims.tokendpoint
+  );
+  const configuredTokenEndpoint = normalizeOptionalString2(
+    options.tokenEndpoint
+  );
+  const tokenEndpoint = configuredTokenEndpoint ?? claimsTokenEndpoint;
   if (!tokenEndpoint) {
-    throw new Error("Token endpoint is required for TURN PAT mode.");
+    throw new Error(
+      "TURN PAT mode requires a PAT token carrying a token endpoint."
+    );
   }
-  const claimsTokenEndpoint = claims.token_endpoint ?? claims.tokendpoint;
-  if (claimsTokenEndpoint !== void 0 && claimsTokenEndpoint !== tokenEndpoint) {
+  if (configuredTokenEndpoint !== void 0 && claimsTokenEndpoint !== void 0 && claimsTokenEndpoint !== configuredTokenEndpoint) {
     throw new Error("Token endpoint does not match the PAT token.");
   }
   const now = normalizeNow(options.now);
@@ -701,7 +713,7 @@ function createPATTURNCredentials(options) {
     crypto.hkdfSync(
       "sha256",
       tokenHash,
-      Buffer.from(clusterDomain, "utf8"),
+      Buffer.from(turnRealm, "utf8"),
       Buffer.from("turn-pat-v1", "utf8"),
       32
     )
@@ -710,14 +722,19 @@ function createPATTURNCredentials(options) {
   return turnCredentialsSchema.parse({
     credential,
     ttl,
-    urls: createTURNURLs(clusterDomain, options.turnPort, options.turnsPort),
+    urls: createTURNURLs(turnDomain, options.turnPort, options.turnsPort),
     username
   });
 }
 async function createAPPTURNCredentials(options) {
-  const clusterDomain = normalizeClusterDomain(options.clusterDomain);
-  if (!clusterDomain) {
-    throw new Error("Cluster domain is required for TURN APP mode.");
+  const legacyDomain = normalizeClusterDomain(options.clusterDomain);
+  const turnDomain = normalizeClusterDomain(options.turnDomain) ?? legacyDomain;
+  const turnRealm = normalizeClusterDomain(options.turnRealm) ?? legacyDomain;
+  if (!turnDomain) {
+    throw new Error("TURN domain is required for TURN APP mode.");
+  }
+  if (!turnRealm) {
+    throw new Error("TURN realm is required for TURN APP mode.");
   }
   const projectEndpoint = normalizeOptionalString2(options.projectEndpoint);
   if (!projectEndpoint) {
@@ -735,7 +752,7 @@ async function createAPPTURNCredentials(options) {
   const exp = normalizeNow(options.now) + ttlSeconds;
   const username = `v1:${exp}:app:${projectEndpoint}:${clientId}`;
   const clientPrivateKey = parseAPPPrivateKey(clientSecret);
-  const serverPublicKeyHex = normalizeOptionalString2(options.serverPublicKeyHex) ?? await loadTURNServerPublicKeyHex(clusterDomain, options);
+  const serverPublicKeyHex = normalizeOptionalString2(options.serverPublicKeyHex) ?? await loadTURNServerPublicKeyHex(turnRealm, options);
   const serverPublicKey = parseTURNServerPublicKeyHex(serverPublicKeyHex);
   requireMatchingCurve(clientPrivateKey, serverPublicKey);
   const sharedSecret = crypto.diffieHellman({
@@ -746,7 +763,7 @@ async function createAPPTURNCredentials(options) {
     crypto.hkdfSync(
       "sha256",
       sharedSecret,
-      Buffer.from(clusterDomain, "utf8"),
+      Buffer.from(turnRealm, "utf8"),
       Buffer.from("turn-app-v1", "utf8"),
       32
     )
@@ -755,7 +772,7 @@ async function createAPPTURNCredentials(options) {
   return turnCredentialsSchema.parse({
     credential,
     ttl: ttlSeconds,
-    urls: createTURNURLs(clusterDomain, options.turnPort, options.turnsPort),
+    urls: createTURNURLs(turnDomain, options.turnPort, options.turnsPort),
     username
   });
 }
@@ -778,28 +795,31 @@ async function createTURNCredentials(options) {
       ttlSeconds: options.ttlSeconds
     });
   }
-  const clusterDomain = normalizeClusterDomain(options.clusterDomain) ?? (projectEndpoint && options.engine ? deriveClusterDomainFromEngine(projectEndpoint, options.engine) : void 0);
+  const legacyDomain = normalizeClusterDomain(options.clusterDomain);
+  const turnDomain = normalizeClusterDomain(options.turnDomain) ?? legacyDomain ?? (projectEndpoint && options.engine ? deriveClusterDomainFromEngine(projectEndpoint, options.engine) : void 0);
+  const turnRealm = normalizeClusterDomain(options.turnRealm) ?? legacyDomain;
   if (mode === "pat") {
     if (!isTokenCredentials2(credentials)) {
       throw new Error("A PAT token is required for TURN PAT mode.");
     }
     return createPATTURNCredentials({
-      clusterDomain: requireOption(
-        clusterDomain,
-        "Cluster domain is required for TURN PAT mode."
-      ),
       now: options.now,
       projectEndpoint: requireOption(
         projectEndpoint,
         "Project endpoint is required for TURN PAT mode."
       ),
       token: credentials.token,
-      tokenEndpoint: requireOption(
-        normalizeOptionalString2(options.tokenEndpoint),
-        "Token endpoint is required for TURN PAT mode."
-      ),
+      tokenEndpoint: options.tokenEndpoint,
       ttlSeconds: options.ttlSeconds,
+      turnDomain: requireOption(
+        turnDomain,
+        "TURN domain is required for TURN PAT mode."
+      ),
       turnPort: options.turnPort,
+      turnRealm: requireOption(
+        turnRealm,
+        "TURN realm is required for TURN PAT mode."
+      ),
       turnsPort: options.turnsPort
     });
   }
@@ -810,10 +830,6 @@ async function createTURNCredentials(options) {
     apiUrl: options.apiUrl,
     clientId: credentials.clientId,
     clientSecret: credentials.clientSecret,
-    clusterDomain: requireOption(
-      clusterDomain,
-      "Cluster domain is required for TURN APP mode."
-    ),
     keyringBaseUrl: options.keyringBaseUrl,
     now: options.now,
     projectEndpoint: requireOption(
@@ -822,24 +838,36 @@ async function createTURNCredentials(options) {
     ),
     serverPublicKeyHex: options.serverPublicKeyHex,
     ttlSeconds: options.ttlSeconds,
+    turnDomain: requireOption(
+      turnDomain,
+      "TURN domain is required for TURN APP mode."
+    ),
     turnPort: options.turnPort,
+    turnRealm: requireOption(
+      turnRealm,
+      "TURN realm is required for TURN APP mode."
+    ),
     turnsPort: options.turnsPort
   });
 }
 
 // src/turn-resource.ts
+import { isClientCredentials as isClientCredentials3 } from "@rstreamlabs/rstream";
 var RstreamTURNResource = class {
   client;
   constructor(client) {
     this.client = client;
   }
   async createCredentials(options = {}) {
-    const engine = options.engine ?? (options.clusterDomain === void 0 ? await this.client.getEngine().catch(() => void 0) : void 0);
+    const credentials = options.credentials ?? this.client.credentials;
+    const localMode = options.mode === "app" || options.mode === "pat" || options.mode === void 0 && isClientCredentials3(credentials);
+    const target = localMode && (options.turnDomain === void 0 || options.turnRealm === void 0) && options.clusterDomain === void 0 ? await this.client.getTURNTarget() : void 0;
+    const engine = options.engine ?? (options.clusterDomain === void 0 && options.turnDomain === void 0 && target === void 0 ? await this.client.getEngine().catch(() => void 0) : void 0);
     return await createTURNCredentials({
       apiUrl: options.apiUrl ?? this.client.apiUrl,
       clusterDomain: options.clusterDomain,
       controlPlaneCredentials: options.controlPlaneCredentials ?? this.client.controlPlaneCredentials,
-      credentials: options.credentials ?? this.client.credentials,
+      credentials,
       engine,
       keyringBaseUrl: options.keyringBaseUrl,
       mode: options.mode,
@@ -849,8 +877,10 @@ var RstreamTURNResource = class {
       serverPublicKeyHex: options.serverPublicKeyHex,
       tokenEndpoint: options.tokenEndpoint,
       ttlSeconds: options.ttlSeconds,
-      turnPort: options.turnPort,
-      turnsPort: options.turnsPort
+      turnDomain: options.turnDomain ?? target?.turnDomain,
+      turnPort: options.turnPort ?? target?.turnPort,
+      turnRealm: options.turnRealm ?? target?.turnRealm,
+      turnsPort: options.turnsPort ?? target?.turnsPort
     });
   }
 };
@@ -1072,6 +1102,27 @@ var RstreamTunnelsClient = class {
       region: this.config?.region
     });
   }
+  async getTURNTarget() {
+    const project = await this.getManagedProject();
+    if (project === void 0) {
+      throw new Error(
+        "Managed project endpoint is required to resolve the TURN target."
+      );
+    }
+    const turnDomain = project.turnDomain?.trim() || project.domain.trim();
+    const turnRealm = project.turnRealm?.trim();
+    if (!turnRealm) {
+      throw new Error(
+        "Managed project metadata does not expose the TURN realm; use API credential mode or provide turnRealm explicitly."
+      );
+    }
+    return {
+      turnDomain,
+      turnPort: project.turnPort,
+      turnRealm,
+      turnsPort: project.turnsPort
+    };
+  }
   async getManagedProject() {
     const projectEndpoint = normalizeOptionalString3(
       this.config?.projectEndpoint
@@ -1148,7 +1199,7 @@ var RstreamTunnelsClient = class {
     if (!credentials) {
       return void 0;
     }
-    if (!isClientCredentials3(credentials)) {
+    if (!isClientCredentials4(credentials)) {
       return credentials.token;
     }
     const tokenParams = await this.getEngineAuthTokenParams();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rstreamlabs/tunnels",
-  "version": "3.8.1",
+  "version": "3.8.2",
   "description": "JS/TS SDK for the rstream Engine API and tunnel runtime APIs.",
   "author": "@uartnet <hello@rstream.io>",
   "repository": {
@@ -47,7 +47,7 @@
     "typescript-config": "*"
   },
   "dependencies": {
-    "@rstreamlabs/rstream": "3.8.0",
+    "@rstreamlabs/rstream": "3.8.1",
     "@types/jsonwebtoken": "^9.0.10",
     "jsonwebtoken": "^9.0.3",
     "zod": "^4.4.3"