@rstreamlabs/tunnels 3.8.1 → 3.8.3

package/dist/index.mjs

@@ -404,7 +404,7 @@ var RstreamTunnelsResource = class {
 
 // src/tunnels.ts
 import { getTunnelsProjectEngine as getTunnelsProjectEngine2 } from "@rstreamlabs/rstream";
-import { isClientCredentials as isClientCredentials3 } from "@rstreamlabs/rstream";
+import { isClientCredentials as isClientCredentials4 } from "@rstreamlabs/rstream";
 import { readEnvironment as readEnvironment2 } from "@rstreamlabs/rstream";
 
 // src/turn.ts
@@ -412,6 +412,52 @@ import { isClientCredentials as isClientCredentials2 } from "@rstreamlabs/rstrea
 import { isTokenCredentials as isTokenCredentials2 } from "@rstreamlabs/rstream";
 import { RstreamClient as RstreamClient2 } from "@rstreamlabs/rstream";
 import { turnCredentialsSchema } from "@rstreamlabs/rstream/turn";
+
+// src/control-plane-fetch.ts
+function createRequestLifetime(parent, timeoutMilliseconds) {
+  const controller = new AbortController();
+  const abort = () => controller.abort(parent.reason);
+  if (parent.aborted) {
+    abort();
+  } else {
+    parent.addEventListener("abort", abort, { once: true });
+  }
+  const timeout = setTimeout(
+    () => controller.abort(new Error("Control plane request timed out.")),
+    timeoutMilliseconds
+  );
+  return {
+    close: () => {
+      clearTimeout(timeout);
+      parent.removeEventListener("abort", abort);
+    },
+    signal: controller.signal
+  };
+}
+function createBoundedControlPlaneFetch(timeoutMilliseconds) {
+  return async (input, init) => {
+    const request = new Request(input, init);
+    const headers = new Headers(request.headers);
+    headers.set("Connection", "close");
+    const lifetime = createRequestLifetime(request.signal, timeoutMilliseconds);
+    try {
+      const response = await globalThis.fetch(request, {
+        headers,
+        signal: lifetime.signal
+      });
+      const responseBody = response.body === null ? null : new Uint8Array(await response.arrayBuffer());
+      return new Response(responseBody, {
+        headers: Object.fromEntries(response.headers.entries()),
+        status: response.status,
+        statusText: response.statusText
+      });
+    } finally {
+      lifetime.close();
+    }
+  };
+}
+
+// src/turn.ts
 import * as z from "zod";
 import crypto from "crypto";
 var defaultTURNPort = 3478;
@@ -419,6 +465,8 @@ var defaultTURNSPort = 5349;
 var defaultTURNCredentialTTLSeconds = 10 * 60;
 var maxTURNCredentialTTLSeconds = 60 * 60;
 var maxTURNKeyringBytes = 8 * 1024;
+var defaultAPIRequestTimeoutMilliseconds = 1e4;
+var maxAPIRequestTimeoutMilliseconds = 6e4;
 var turnTokenClaimsSchema = z.object({
   exp: z.number().int().optional(),
   iat: z.number().int().optional(),
@@ -452,6 +500,15 @@ function normalizeTTLSeconds(ttlSeconds) {
   }
   return ttl;
 }
+function normalizeAPIRequestTimeoutMilliseconds(timeoutMilliseconds) {
+  const timeout = timeoutMilliseconds ?? defaultAPIRequestTimeoutMilliseconds;
+  if (!Number.isInteger(timeout) || timeout < 1 || timeout > maxAPIRequestTimeoutMilliseconds) {
+    throw new Error(
+      "TURN API request timeout must be an integer between 1 and 60000 milliseconds."
+    );
+  }
+  return timeout;
+}
 function createAPITURNCredentialsParams(ttlSeconds) {
   return ttlSeconds === void 0 ? {} : { ttlSeconds: normalizeTTLSeconds(ttlSeconds) };
 }
@@ -468,14 +525,14 @@ function normalizeTURNPort(port) {
 function normalizeTURNSPort(port) {
   return normalizePort(port, defaultTURNSPort, "TURNS port");
 }
-function createTURNURLs(clusterDomain, turnPort, turnsPort) {
+function createTURNURLs(turnDomain, turnPort, turnsPort) {
   const normalizedTURNPort = normalizeTURNPort(turnPort);
   const normalizedTURNSPort = normalizeTURNSPort(turnsPort);
   return [
-    `turn:${clusterDomain}:${normalizedTURNPort}?transport=udp`,
-    `turn:${clusterDomain}:${normalizedTURNPort}?transport=tcp`,
-    `turns:${clusterDomain}:${normalizedTURNSPort}?transport=udp`,
-    `turns:${clusterDomain}:${normalizedTURNSPort}?transport=tcp`
+    `turn:${turnDomain}:${normalizedTURNPort}?transport=udp`,
+    `turn:${turnDomain}:${normalizedTURNPort}?transport=tcp`,
+    `turns:${turnDomain}:${normalizedTURNSPort}?transport=udp`,
+    `turns:${turnDomain}:${normalizedTURNSPort}?transport=tcp`
   ];
 }
 function parseTURNTokenClaims(token) {
@@ -645,11 +702,16 @@ async function createAPITURNCredentials(options) {
       "Project ID or project endpoint is required for TURN API mode."
     );
   }
+  const requestTimeoutMilliseconds = normalizeAPIRequestTimeoutMilliseconds(
+    options.requestTimeoutMilliseconds
+  );
+  const params = createAPITURNCredentialsParams(options.ttlSeconds);
+  const request = options.fetch ?? createBoundedControlPlaneFetch(requestTimeoutMilliseconds);
   const client = new RstreamClient2({
     apiUrl: options.apiUrl,
-    credentials: options.credentials
+    credentials: options.credentials,
+    fetch: request
   });
-  const params = createAPITURNCredentialsParams(options.ttlSeconds);
   if (projectId) {
     return await client.tunnels.projects.createTurnCredentials(
       projectId,
@@ -667,9 +729,14 @@ async function createAPITURNCredentials(options) {
   );
 }
 function createPATTURNCredentials(options) {
-  const clusterDomain = normalizeClusterDomain(options.clusterDomain);
-  if (!clusterDomain) {
-    throw new Error("Cluster domain is required for TURN PAT mode.");
+  const legacyDomain = normalizeClusterDomain(options.clusterDomain);
+  const turnDomain = normalizeClusterDomain(options.turnDomain) ?? legacyDomain;
+  const turnRealm = normalizeClusterDomain(options.turnRealm) ?? legacyDomain;
+  if (!turnDomain) {
+    throw new Error("TURN domain is required for TURN PAT mode.");
+  }
+  if (!turnRealm) {
+    throw new Error("TURN realm is required for TURN PAT mode.");
   }
   const projectEndpoint = normalizeOptionalString2(options.projectEndpoint);
   if (!projectEndpoint) {
@@ -683,12 +750,19 @@ function createPATTURNCredentials(options) {
   if (claims.type !== "pat") {
     throw new Error("TURN PAT mode requires a PAT token.");
   }
-  const tokenEndpoint = normalizeOptionalString2(options.tokenEndpoint);
+  const claimsTokenEndpoint = normalizeOptionalString2(
+    claims.token_endpoint ?? claims.tokendpoint
+  );
+  const configuredTokenEndpoint = normalizeOptionalString2(
+    options.tokenEndpoint
+  );
+  const tokenEndpoint = configuredTokenEndpoint ?? claimsTokenEndpoint;
   if (!tokenEndpoint) {
-    throw new Error("Token endpoint is required for TURN PAT mode.");
+    throw new Error(
+      "TURN PAT mode requires a PAT token carrying a token endpoint."
+    );
   }
-  const claimsTokenEndpoint = claims.token_endpoint ?? claims.tokendpoint;
-  if (claimsTokenEndpoint !== void 0 && claimsTokenEndpoint !== tokenEndpoint) {
+  if (configuredTokenEndpoint !== void 0 && claimsTokenEndpoint !== void 0 && claimsTokenEndpoint !== configuredTokenEndpoint) {
     throw new Error("Token endpoint does not match the PAT token.");
   }
   const now = normalizeNow(options.now);
@@ -701,7 +775,7 @@ function createPATTURNCredentials(options) {
     crypto.hkdfSync(
       "sha256",
       tokenHash,
-      Buffer.from(clusterDomain, "utf8"),
+      Buffer.from(turnRealm, "utf8"),
       Buffer.from("turn-pat-v1", "utf8"),
       32
     )
@@ -710,14 +784,19 @@ function createPATTURNCredentials(options) {
   return turnCredentialsSchema.parse({
     credential,
     ttl,
-    urls: createTURNURLs(clusterDomain, options.turnPort, options.turnsPort),
+    urls: createTURNURLs(turnDomain, options.turnPort, options.turnsPort),
     username
   });
 }
 async function createAPPTURNCredentials(options) {
-  const clusterDomain = normalizeClusterDomain(options.clusterDomain);
-  if (!clusterDomain) {
-    throw new Error("Cluster domain is required for TURN APP mode.");
+  const legacyDomain = normalizeClusterDomain(options.clusterDomain);
+  const turnDomain = normalizeClusterDomain(options.turnDomain) ?? legacyDomain;
+  const turnRealm = normalizeClusterDomain(options.turnRealm) ?? legacyDomain;
+  if (!turnDomain) {
+    throw new Error("TURN domain is required for TURN APP mode.");
+  }
+  if (!turnRealm) {
+    throw new Error("TURN realm is required for TURN APP mode.");
   }
   const projectEndpoint = normalizeOptionalString2(options.projectEndpoint);
   if (!projectEndpoint) {
@@ -735,7 +814,7 @@ async function createAPPTURNCredentials(options) {
   const exp = normalizeNow(options.now) + ttlSeconds;
   const username = `v1:${exp}:app:${projectEndpoint}:${clientId}`;
   const clientPrivateKey = parseAPPPrivateKey(clientSecret);
-  const serverPublicKeyHex = normalizeOptionalString2(options.serverPublicKeyHex) ?? await loadTURNServerPublicKeyHex(clusterDomain, options);
+  const serverPublicKeyHex = normalizeOptionalString2(options.serverPublicKeyHex) ?? await loadTURNServerPublicKeyHex(turnRealm, options);
   const serverPublicKey = parseTURNServerPublicKeyHex(serverPublicKeyHex);
   requireMatchingCurve(clientPrivateKey, serverPublicKey);
   const sharedSecret = crypto.diffieHellman({
@@ -746,7 +825,7 @@ async function createAPPTURNCredentials(options) {
     crypto.hkdfSync(
       "sha256",
       sharedSecret,
-      Buffer.from(clusterDomain, "utf8"),
+      Buffer.from(turnRealm, "utf8"),
       Buffer.from("turn-app-v1", "utf8"),
       32
     )
@@ -755,7 +834,7 @@ async function createAPPTURNCredentials(options) {
   return turnCredentialsSchema.parse({
     credential,
     ttl: ttlSeconds,
-    urls: createTURNURLs(clusterDomain, options.turnPort, options.turnsPort),
+    urls: createTURNURLs(turnDomain, options.turnPort, options.turnsPort),
     username
   });
 }
@@ -773,33 +852,38 @@ async function createTURNCredentials(options) {
     return await createAPITURNCredentials({
       apiUrl: options.apiUrl,
       credentials: controlPlaneCredentials,
+      fetch: options.fetch,
       projectEndpoint,
       projectId: options.projectId,
+      requestTimeoutMilliseconds: options.requestTimeoutMilliseconds,
       ttlSeconds: options.ttlSeconds
     });
   }
-  const clusterDomain = normalizeClusterDomain(options.clusterDomain) ?? (projectEndpoint && options.engine ? deriveClusterDomainFromEngine(projectEndpoint, options.engine) : void 0);
+  const legacyDomain = normalizeClusterDomain(options.clusterDomain);
+  const turnDomain = normalizeClusterDomain(options.turnDomain) ?? legacyDomain ?? (projectEndpoint && options.engine ? deriveClusterDomainFromEngine(projectEndpoint, options.engine) : void 0);
+  const turnRealm = normalizeClusterDomain(options.turnRealm) ?? legacyDomain;
   if (mode === "pat") {
     if (!isTokenCredentials2(credentials)) {
       throw new Error("A PAT token is required for TURN PAT mode.");
     }
     return createPATTURNCredentials({
-      clusterDomain: requireOption(
-        clusterDomain,
-        "Cluster domain is required for TURN PAT mode."
-      ),
       now: options.now,
       projectEndpoint: requireOption(
         projectEndpoint,
         "Project endpoint is required for TURN PAT mode."
       ),
       token: credentials.token,
-      tokenEndpoint: requireOption(
-        normalizeOptionalString2(options.tokenEndpoint),
-        "Token endpoint is required for TURN PAT mode."
-      ),
+      tokenEndpoint: options.tokenEndpoint,
       ttlSeconds: options.ttlSeconds,
+      turnDomain: requireOption(
+        turnDomain,
+        "TURN domain is required for TURN PAT mode."
+      ),
       turnPort: options.turnPort,
+      turnRealm: requireOption(
+        turnRealm,
+        "TURN realm is required for TURN PAT mode."
+      ),
       turnsPort: options.turnsPort
     });
   }
@@ -810,10 +894,6 @@ async function createTURNCredentials(options) {
     apiUrl: options.apiUrl,
     clientId: credentials.clientId,
     clientSecret: credentials.clientSecret,
-    clusterDomain: requireOption(
-      clusterDomain,
-      "Cluster domain is required for TURN APP mode."
-    ),
     keyringBaseUrl: options.keyringBaseUrl,
     now: options.now,
     projectEndpoint: requireOption(
@@ -822,24 +902,36 @@ async function createTURNCredentials(options) {
     ),
     serverPublicKeyHex: options.serverPublicKeyHex,
     ttlSeconds: options.ttlSeconds,
+    turnDomain: requireOption(
+      turnDomain,
+      "TURN domain is required for TURN APP mode."
+    ),
     turnPort: options.turnPort,
+    turnRealm: requireOption(
+      turnRealm,
+      "TURN realm is required for TURN APP mode."
+    ),
     turnsPort: options.turnsPort
   });
 }
 
 // src/turn-resource.ts
+import { isClientCredentials as isClientCredentials3 } from "@rstreamlabs/rstream";
 var RstreamTURNResource = class {
   client;
   constructor(client) {
     this.client = client;
   }
   async createCredentials(options = {}) {
-    const engine = options.engine ?? (options.clusterDomain === void 0 ? await this.client.getEngine().catch(() => void 0) : void 0);
+    const credentials = options.credentials ?? this.client.credentials;
+    const localMode = options.mode === "app" || options.mode === "pat" || options.mode === void 0 && isClientCredentials3(credentials);
+    const target = localMode && (options.turnDomain === void 0 || options.turnRealm === void 0) && options.clusterDomain === void 0 ? await this.client.getTURNTarget() : void 0;
+    const engine = options.engine ?? (options.clusterDomain === void 0 && options.turnDomain === void 0 && target === void 0 ? await this.client.getEngine().catch(() => void 0) : void 0);
     return await createTURNCredentials({
       apiUrl: options.apiUrl ?? this.client.apiUrl,
       clusterDomain: options.clusterDomain,
       controlPlaneCredentials: options.controlPlaneCredentials ?? this.client.controlPlaneCredentials,
-      credentials: options.credentials ?? this.client.credentials,
+      credentials,
       engine,
       keyringBaseUrl: options.keyringBaseUrl,
       mode: options.mode,
@@ -849,8 +941,10 @@ var RstreamTURNResource = class {
       serverPublicKeyHex: options.serverPublicKeyHex,
       tokenEndpoint: options.tokenEndpoint,
       ttlSeconds: options.ttlSeconds,
-      turnPort: options.turnPort,
-      turnsPort: options.turnsPort
+      turnDomain: options.turnDomain ?? target?.turnDomain,
+      turnPort: options.turnPort ?? target?.turnPort,
+      turnRealm: options.turnRealm ?? target?.turnRealm,
+      turnsPort: options.turnsPort ?? target?.turnsPort
     });
   }
 };
@@ -1072,6 +1166,27 @@ var RstreamTunnelsClient = class {
       region: this.config?.region
     });
   }
+  async getTURNTarget() {
+    const project = await this.getManagedProject();
+    if (project === void 0) {
+      throw new Error(
+        "Managed project endpoint is required to resolve the TURN target."
+      );
+    }
+    const turnDomain = project.turnDomain?.trim() || project.domain.trim();
+    const turnRealm = project.turnRealm?.trim();
+    if (!turnRealm) {
+      throw new Error(
+        "Managed project metadata does not expose the TURN realm; use API credential mode or provide turnRealm explicitly."
+      );
+    }
+    return {
+      turnDomain,
+      turnPort: project.turnPort,
+      turnRealm,
+      turnsPort: project.turnsPort
+    };
+  }
   async getManagedProject() {
     const projectEndpoint = normalizeOptionalString3(
       this.config?.projectEndpoint
@@ -1148,7 +1263,7 @@ var RstreamTunnelsClient = class {
     if (!credentials) {
       return void 0;
     }
-    if (!isClientCredentials3(credentials)) {
+    if (!isClientCredentials4(credentials)) {
       return credentials.token;
     }
     const tokenParams = await this.getEngineAuthTokenParams();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rstreamlabs/tunnels",
-  "version": "3.8.1",
+  "version": "3.8.3",
   "description": "JS/TS SDK for the rstream Engine API and tunnel runtime APIs.",
   "author": "@uartnet <hello@rstream.io>",
   "repository": {
@@ -47,7 +47,7 @@
     "typescript-config": "*"
   },
   "dependencies": {
-    "@rstreamlabs/rstream": "3.8.0",
+    "@rstreamlabs/rstream": "3.8.2",
     "@types/jsonwebtoken": "^9.0.10",
     "jsonwebtoken": "^9.0.3",
     "zod": "^4.4.3"