@rstreamlabs/tunnels 3.8.1 → 3.8.3

package/dist/index.js

@@ -1766,15 +1766,61 @@ var RstreamTunnelsResource = class {
 };
 
 // src/tunnels.ts
-var import_rstream11 = require("@rstreamlabs/rstream");
 var import_rstream12 = require("@rstreamlabs/rstream");
 var import_rstream13 = require("@rstreamlabs/rstream");
+var import_rstream14 = require("@rstreamlabs/rstream");
 
 // src/turn.ts
 var import_rstream8 = require("@rstreamlabs/rstream");
 var import_rstream9 = require("@rstreamlabs/rstream");
 var import_rstream10 = require("@rstreamlabs/rstream");
 var import_turn = require("@rstreamlabs/rstream/turn");
+
+// src/control-plane-fetch.ts
+function createRequestLifetime(parent, timeoutMilliseconds) {
+  const controller = new AbortController();
+  const abort = () => controller.abort(parent.reason);
+  if (parent.aborted) {
+    abort();
+  } else {
+    parent.addEventListener("abort", abort, { once: true });
+  }
+  const timeout = setTimeout(
+    () => controller.abort(new Error("Control plane request timed out.")),
+    timeoutMilliseconds
+  );
+  return {
+    close: () => {
+      clearTimeout(timeout);
+      parent.removeEventListener("abort", abort);
+    },
+    signal: controller.signal
+  };
+}
+function createBoundedControlPlaneFetch(timeoutMilliseconds) {
+  return async (input, init) => {
+    const request = new Request(input, init);
+    const headers = new Headers(request.headers);
+    headers.set("Connection", "close");
+    const lifetime = createRequestLifetime(request.signal, timeoutMilliseconds);
+    try {
+      const response = await globalThis.fetch(request, {
+        headers,
+        signal: lifetime.signal
+      });
+      const responseBody = response.body === null ? null : new Uint8Array(await response.arrayBuffer());
+      return new Response(responseBody, {
+        headers: Object.fromEntries(response.headers.entries()),
+        status: response.status,
+        statusText: response.statusText
+      });
+    } finally {
+      lifetime.close();
+    }
+  };
+}
+
+// src/turn.ts
 var z8 = __toESM(require("zod"));
 var import_crypto = __toESM(require("crypto"));
 var defaultTURNPort = 3478;
@@ -1782,6 +1828,8 @@ var defaultTURNSPort = 5349;
 var defaultTURNCredentialTTLSeconds = 10 * 60;
 var maxTURNCredentialTTLSeconds = 60 * 60;
 var maxTURNKeyringBytes = 8 * 1024;
+var defaultAPIRequestTimeoutMilliseconds = 1e4;
+var maxAPIRequestTimeoutMilliseconds = 6e4;
 var turnTokenClaimsSchema = z8.object({
   exp: z8.number().int().optional(),
   iat: z8.number().int().optional(),
@@ -1815,6 +1863,15 @@ function normalizeTTLSeconds(ttlSeconds) {
   }
   return ttl;
 }
+function normalizeAPIRequestTimeoutMilliseconds(timeoutMilliseconds) {
+  const timeout = timeoutMilliseconds ?? defaultAPIRequestTimeoutMilliseconds;
+  if (!Number.isInteger(timeout) || timeout < 1 || timeout > maxAPIRequestTimeoutMilliseconds) {
+    throw new Error(
+      "TURN API request timeout must be an integer between 1 and 60000 milliseconds."
+    );
+  }
+  return timeout;
+}
 function createAPITURNCredentialsParams(ttlSeconds) {
   return ttlSeconds === void 0 ? {} : { ttlSeconds: normalizeTTLSeconds(ttlSeconds) };
 }
@@ -1831,14 +1888,14 @@ function normalizeTURNPort(port) {
 function normalizeTURNSPort(port) {
   return normalizePort(port, defaultTURNSPort, "TURNS port");
 }
-function createTURNURLs(clusterDomain, turnPort, turnsPort) {
+function createTURNURLs(turnDomain, turnPort, turnsPort) {
   const normalizedTURNPort = normalizeTURNPort(turnPort);
   const normalizedTURNSPort = normalizeTURNSPort(turnsPort);
   return [
-    `turn:${clusterDomain}:${normalizedTURNPort}?transport=udp`,
-    `turn:${clusterDomain}:${normalizedTURNPort}?transport=tcp`,
-    `turns:${clusterDomain}:${normalizedTURNSPort}?transport=udp`,
-    `turns:${clusterDomain}:${normalizedTURNSPort}?transport=tcp`
+    `turn:${turnDomain}:${normalizedTURNPort}?transport=udp`,
+    `turn:${turnDomain}:${normalizedTURNPort}?transport=tcp`,
+    `turns:${turnDomain}:${normalizedTURNSPort}?transport=udp`,
+    `turns:${turnDomain}:${normalizedTURNSPort}?transport=tcp`
   ];
 }
 function parseTURNTokenClaims(token) {
@@ -2008,11 +2065,16 @@ async function createAPITURNCredentials(options) {
       "Project ID or project endpoint is required for TURN API mode."
     );
   }
+  const requestTimeoutMilliseconds = normalizeAPIRequestTimeoutMilliseconds(
+    options.requestTimeoutMilliseconds
+  );
+  const params = createAPITURNCredentialsParams(options.ttlSeconds);
+  const request = options.fetch ?? createBoundedControlPlaneFetch(requestTimeoutMilliseconds);
   const client = new import_rstream10.RstreamClient({
     apiUrl: options.apiUrl,
-    credentials: options.credentials
+    credentials: options.credentials,
+    fetch: request
   });
-  const params = createAPITURNCredentialsParams(options.ttlSeconds);
   if (projectId) {
     return await client.tunnels.projects.createTurnCredentials(
       projectId,
@@ -2030,9 +2092,14 @@ async function createAPITURNCredentials(options) {
   );
 }
 function createPATTURNCredentials(options) {
-  const clusterDomain = normalizeClusterDomain(options.clusterDomain);
-  if (!clusterDomain) {
-    throw new Error("Cluster domain is required for TURN PAT mode.");
+  const legacyDomain = normalizeClusterDomain(options.clusterDomain);
+  const turnDomain = normalizeClusterDomain(options.turnDomain) ?? legacyDomain;
+  const turnRealm = normalizeClusterDomain(options.turnRealm) ?? legacyDomain;
+  if (!turnDomain) {
+    throw new Error("TURN domain is required for TURN PAT mode.");
+  }
+  if (!turnRealm) {
+    throw new Error("TURN realm is required for TURN PAT mode.");
   }
   const projectEndpoint = normalizeOptionalString2(options.projectEndpoint);
   if (!projectEndpoint) {
@@ -2046,12 +2113,19 @@ function createPATTURNCredentials(options) {
   if (claims.type !== "pat") {
     throw new Error("TURN PAT mode requires a PAT token.");
   }
-  const tokenEndpoint = normalizeOptionalString2(options.tokenEndpoint);
+  const claimsTokenEndpoint = normalizeOptionalString2(
+    claims.token_endpoint ?? claims.tokendpoint
+  );
+  const configuredTokenEndpoint = normalizeOptionalString2(
+    options.tokenEndpoint
+  );
+  const tokenEndpoint = configuredTokenEndpoint ?? claimsTokenEndpoint;
   if (!tokenEndpoint) {
-    throw new Error("Token endpoint is required for TURN PAT mode.");
+    throw new Error(
+      "TURN PAT mode requires a PAT token carrying a token endpoint."
+    );
   }
-  const claimsTokenEndpoint = claims.token_endpoint ?? claims.tokendpoint;
-  if (claimsTokenEndpoint !== void 0 && claimsTokenEndpoint !== tokenEndpoint) {
+  if (configuredTokenEndpoint !== void 0 && claimsTokenEndpoint !== void 0 && claimsTokenEndpoint !== configuredTokenEndpoint) {
     throw new Error("Token endpoint does not match the PAT token.");
   }
   const now = normalizeNow(options.now);
@@ -2064,7 +2138,7 @@ function createPATTURNCredentials(options) {
     import_crypto.default.hkdfSync(
       "sha256",
       tokenHash,
-      Buffer.from(clusterDomain, "utf8"),
+      Buffer.from(turnRealm, "utf8"),
       Buffer.from("turn-pat-v1", "utf8"),
       32
     )
@@ -2073,14 +2147,19 @@ function createPATTURNCredentials(options) {
   return import_turn.turnCredentialsSchema.parse({
     credential,
     ttl,
-    urls: createTURNURLs(clusterDomain, options.turnPort, options.turnsPort),
+    urls: createTURNURLs(turnDomain, options.turnPort, options.turnsPort),
     username
   });
 }
 async function createAPPTURNCredentials(options) {
-  const clusterDomain = normalizeClusterDomain(options.clusterDomain);
-  if (!clusterDomain) {
-    throw new Error("Cluster domain is required for TURN APP mode.");
+  const legacyDomain = normalizeClusterDomain(options.clusterDomain);
+  const turnDomain = normalizeClusterDomain(options.turnDomain) ?? legacyDomain;
+  const turnRealm = normalizeClusterDomain(options.turnRealm) ?? legacyDomain;
+  if (!turnDomain) {
+    throw new Error("TURN domain is required for TURN APP mode.");
+  }
+  if (!turnRealm) {
+    throw new Error("TURN realm is required for TURN APP mode.");
   }
   const projectEndpoint = normalizeOptionalString2(options.projectEndpoint);
   if (!projectEndpoint) {
@@ -2098,7 +2177,7 @@ async function createAPPTURNCredentials(options) {
   const exp = normalizeNow(options.now) + ttlSeconds;
   const username = `v1:${exp}:app:${projectEndpoint}:${clientId}`;
   const clientPrivateKey = parseAPPPrivateKey(clientSecret);
-  const serverPublicKeyHex = normalizeOptionalString2(options.serverPublicKeyHex) ?? await loadTURNServerPublicKeyHex(clusterDomain, options);
+  const serverPublicKeyHex = normalizeOptionalString2(options.serverPublicKeyHex) ?? await loadTURNServerPublicKeyHex(turnRealm, options);
   const serverPublicKey = parseTURNServerPublicKeyHex(serverPublicKeyHex);
   requireMatchingCurve(clientPrivateKey, serverPublicKey);
   const sharedSecret = import_crypto.default.diffieHellman({
@@ -2109,7 +2188,7 @@ async function createAPPTURNCredentials(options) {
     import_crypto.default.hkdfSync(
       "sha256",
       sharedSecret,
-      Buffer.from(clusterDomain, "utf8"),
+      Buffer.from(turnRealm, "utf8"),
       Buffer.from("turn-app-v1", "utf8"),
       32
     )
@@ -2118,7 +2197,7 @@ async function createAPPTURNCredentials(options) {
   return import_turn.turnCredentialsSchema.parse({
     credential,
     ttl: ttlSeconds,
-    urls: createTURNURLs(clusterDomain, options.turnPort, options.turnsPort),
+    urls: createTURNURLs(turnDomain, options.turnPort, options.turnsPort),
     username
   });
 }
@@ -2136,33 +2215,38 @@ async function createTURNCredentials(options) {
     return await createAPITURNCredentials({
       apiUrl: options.apiUrl,
       credentials: controlPlaneCredentials,
+      fetch: options.fetch,
       projectEndpoint,
       projectId: options.projectId,
+      requestTimeoutMilliseconds: options.requestTimeoutMilliseconds,
       ttlSeconds: options.ttlSeconds
     });
   }
-  const clusterDomain = normalizeClusterDomain(options.clusterDomain) ?? (projectEndpoint && options.engine ? deriveClusterDomainFromEngine(projectEndpoint, options.engine) : void 0);
+  const legacyDomain = normalizeClusterDomain(options.clusterDomain);
+  const turnDomain = normalizeClusterDomain(options.turnDomain) ?? legacyDomain ?? (projectEndpoint && options.engine ? deriveClusterDomainFromEngine(projectEndpoint, options.engine) : void 0);
+  const turnRealm = normalizeClusterDomain(options.turnRealm) ?? legacyDomain;
   if (mode === "pat") {
     if (!(0, import_rstream9.isTokenCredentials)(credentials)) {
       throw new Error("A PAT token is required for TURN PAT mode.");
     }
     return createPATTURNCredentials({
-      clusterDomain: requireOption(
-        clusterDomain,
-        "Cluster domain is required for TURN PAT mode."
-      ),
       now: options.now,
       projectEndpoint: requireOption(
         projectEndpoint,
         "Project endpoint is required for TURN PAT mode."
       ),
       token: credentials.token,
-      tokenEndpoint: requireOption(
-        normalizeOptionalString2(options.tokenEndpoint),
-        "Token endpoint is required for TURN PAT mode."
-      ),
+      tokenEndpoint: options.tokenEndpoint,
       ttlSeconds: options.ttlSeconds,
+      turnDomain: requireOption(
+        turnDomain,
+        "TURN domain is required for TURN PAT mode."
+      ),
       turnPort: options.turnPort,
+      turnRealm: requireOption(
+        turnRealm,
+        "TURN realm is required for TURN PAT mode."
+      ),
       turnsPort: options.turnsPort
     });
   }
@@ -2173,10 +2257,6 @@ async function createTURNCredentials(options) {
     apiUrl: options.apiUrl,
     clientId: credentials.clientId,
     clientSecret: credentials.clientSecret,
-    clusterDomain: requireOption(
-      clusterDomain,
-      "Cluster domain is required for TURN APP mode."
-    ),
     keyringBaseUrl: options.keyringBaseUrl,
     now: options.now,
     projectEndpoint: requireOption(
@@ -2185,24 +2265,36 @@ async function createTURNCredentials(options) {
     ),
     serverPublicKeyHex: options.serverPublicKeyHex,
     ttlSeconds: options.ttlSeconds,
+    turnDomain: requireOption(
+      turnDomain,
+      "TURN domain is required for TURN APP mode."
+    ),
     turnPort: options.turnPort,
+    turnRealm: requireOption(
+      turnRealm,
+      "TURN realm is required for TURN APP mode."
+    ),
     turnsPort: options.turnsPort
   });
 }
 
 // src/turn-resource.ts
+var import_rstream11 = require("@rstreamlabs/rstream");
 var RstreamTURNResource = class {
   client;
   constructor(client) {
     this.client = client;
   }
   async createCredentials(options = {}) {
-    const engine = options.engine ?? (options.clusterDomain === void 0 ? await this.client.getEngine().catch(() => void 0) : void 0);
+    const credentials = options.credentials ?? this.client.credentials;
+    const localMode = options.mode === "app" || options.mode === "pat" || options.mode === void 0 && (0, import_rstream11.isClientCredentials)(credentials);
+    const target = localMode && (options.turnDomain === void 0 || options.turnRealm === void 0) && options.clusterDomain === void 0 ? await this.client.getTURNTarget() : void 0;
+    const engine = options.engine ?? (options.clusterDomain === void 0 && options.turnDomain === void 0 && target === void 0 ? await this.client.getEngine().catch(() => void 0) : void 0);
     return await createTURNCredentials({
       apiUrl: options.apiUrl ?? this.client.apiUrl,
       clusterDomain: options.clusterDomain,
       controlPlaneCredentials: options.controlPlaneCredentials ?? this.client.controlPlaneCredentials,
-      credentials: options.credentials ?? this.client.credentials,
+      credentials,
       engine,
       keyringBaseUrl: options.keyringBaseUrl,
       mode: options.mode,
@@ -2212,8 +2304,10 @@ var RstreamTURNResource = class {
       serverPublicKeyHex: options.serverPublicKeyHex,
       tokenEndpoint: options.tokenEndpoint,
       ttlSeconds: options.ttlSeconds,
-      turnPort: options.turnPort,
-      turnsPort: options.turnsPort
+      turnDomain: options.turnDomain ?? target?.turnDomain,
+      turnPort: options.turnPort ?? target?.turnPort,
+      turnRealm: options.turnRealm ?? target?.turnRealm,
+      turnsPort: options.turnsPort ?? target?.turnsPort
     });
   }
 };
@@ -2394,7 +2488,7 @@ var RstreamTunnelsClient = class {
       this.config?.projectEndpoint
     );
     if (region !== void 0) {
-      if (normalizeOptionalString3(this.config?.engine) !== void 0 || (0, import_rstream13.readEnvironment)().engine !== void 0) {
+      if (normalizeOptionalString3(this.config?.engine) !== void 0 || (0, import_rstream14.readEnvironment)().engine !== void 0) {
         throw new Error(
           "Region selection cannot be combined with an explicit engine override."
         );
@@ -2406,17 +2500,17 @@ var RstreamTunnelsClient = class {
       }
       const project = await this.getManagedProject();
       if (project !== void 0) {
-        const engine = (0, import_rstream11.getTunnelsProjectEngine)(project, region);
+        const engine = (0, import_rstream12.getTunnelsProjectEngine)(project, region);
         if (engine) return normalizeEngineAddress(engine);
       }
       throw new Error(
         "Failed to resolve the selected regional engine from the managed tunnels project."
       );
     }
-    if (projectEndpoint !== void 0 && normalizeOptionalString3(this.config?.engine) === void 0 && (0, import_rstream13.readEnvironment)().engine === void 0) {
+    if (projectEndpoint !== void 0 && normalizeOptionalString3(this.config?.engine) === void 0 && (0, import_rstream14.readEnvironment)().engine === void 0) {
       const project = await this.getManagedProject();
       if (project !== void 0) {
-        const engine = (0, import_rstream11.getTunnelsProjectEngine)(project);
+        const engine = (0, import_rstream12.getTunnelsProjectEngine)(project);
         if (engine) {
           return normalizeEngineAddress(engine);
         }
@@ -2435,6 +2529,27 @@ var RstreamTunnelsClient = class {
       region: this.config?.region
     });
   }
+  async getTURNTarget() {
+    const project = await this.getManagedProject();
+    if (project === void 0) {
+      throw new Error(
+        "Managed project endpoint is required to resolve the TURN target."
+      );
+    }
+    const turnDomain = project.turnDomain?.trim() || project.domain.trim();
+    const turnRealm = project.turnRealm?.trim();
+    if (!turnRealm) {
+      throw new Error(
+        "Managed project metadata does not expose the TURN realm; use API credential mode or provide turnRealm explicitly."
+      );
+    }
+    return {
+      turnDomain,
+      turnPort: project.turnPort,
+      turnRealm,
+      turnsPort: project.turnsPort
+    };
+  }
   async getManagedProject() {
     const projectEndpoint = normalizeOptionalString3(
       this.config?.projectEndpoint
@@ -2511,7 +2626,7 @@ var RstreamTunnelsClient = class {
     if (!credentials) {
       return void 0;
     }
-    if (!(0, import_rstream12.isClientCredentials)(credentials)) {
+    if (!(0, import_rstream13.isClientCredentials)(credentials)) {
       return credentials.token;
     }
     const tokenParams = await this.getEngineAuthTokenParams();