@decartai/sdk 0.0.61 → 0.0.63

package/dist/realtime/client.d.ts

@@ -25,7 +25,7 @@ declare const realTimeClientConnectOptionsSchema: z.ZodObject<{
     fps: z.ZodNumber;
     width: z.ZodNumber;
     height: z.ZodNumber;
-    inputSchema: z.ZodAny;
+    inputSchema: z.ZodOptional<z.ZodAny>;
   }, z.core.$strip>;
   onRemoteStream: z.ZodCustom<OnRemoteStreamFn, OnRemoteStreamFn>;
   initialState: z.ZodOptional<z.ZodObject<{

package/dist/shared/model.js

@@ -172,7 +172,7 @@ const modelDefinitionSchema = z.object({
 	fps: z.number().min(1),
 	width: z.number().min(1),
 	height: z.number().min(1),
-	inputSchema: z.any()
+	inputSchema: z.any().optional()
 });
 const _models = {
 	realtime: {

package/dist/tokens/client.d.ts

@@ -9,6 +9,13 @@ type CreateTokenOptions = {
   expiresIn?: number;
   /** Restrict which models this token can access (max 20 items). */
   allowedModels?: (Model | (string & {}))[];
+  /**
+   * Restrict which web origins this token can be used from (max 20 items).
+   * Each entry must be a full origin including scheme, e.g. `https://example.com`.
+   * Enforced on realtime sessions by matching the WebSocket `Origin` header
+   * verbatim. Defense-in-depth — only effective for browser-based clients.
+   */
+  allowedOrigins?: string[];
   /** Operational limits for the token. */
   constraints?: {
     realtime?: {
@@ -19,9 +26,10 @@ type CreateTokenOptions = {
 type CreateTokenResponse = {
   apiKey: string;
   expiresAt: string;
-  /** Present when `allowedModels` was set on the request. */
+  /** Present when `allowedModels` and/or `allowedOrigins` were set on the request. */
   permissions?: {
-    models: (Model | (string & {}))[];
+    models?: (Model | (string & {}))[];
+    origins?: string[];
   } | null;
   /** Present when `constraints` was set on the request. */
   constraints?: {
@@ -45,10 +53,11 @@ type TokensClient = {
    * // With metadata:
    * const token = await client.tokens.create({ metadata: { role: "viewer" } });
    *
-   * // With expiry, model restrictions, and constraints:
+   * // With expiry, model restrictions, origin restrictions, and constraints:
    * const token = await client.tokens.create({
    *   expiresIn: 300,
    *   allowedModels: ["lucy-pro-v2v", "lucy-restyle-v2v"],
+   *   allowedOrigins: ["https://example.com"],
    *   constraints: { realtime: { maxSessionDuration: 120 } },
    * });
    * ```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decartai/sdk",
-  "version": "0.0.61",
+  "version": "0.0.63",
   "description": "Decart's JavaScript SDK",
   "type": "module",
   "license": "MIT",