@decartai/sdk 0.2.2 → 0.2.3

package/README.md

@@ -290,6 +290,38 @@ if (status.status === "completed") {
 }
 ```
 
+### Client Tokens
+
+Mint short-lived client tokens on your server instead of shipping your API key.
+The response also carries a signed JWT (`token`) that any server or edge runtime
+can verify **offline** against the platform's public JWKS — no API key, no
+round-trip to Decart:
+
+```ts
+import { createDecartClient, verifyClientToken, decodeClientToken } from "@decartai/sdk";
+
+const client = createDecartClient({ apiKey: process.env.DECART_API_KEY });
+const { apiKey, token } = await client.tokens.create({ expiresIn: 300, metadata: { service_tier: 0 } });
+
+// Verify offline (EdDSA signature, exp, iss, aud) and read the claims
+const claims = await verifyClientToken(token); // or client.tokens.verify(token)
+claims.serviceTier; // 0
+claims.pool; // "free" for tier 0, otherwise "paid"
+// also: userId, organizationId, apiKeyName, apiKeyId, allowedModels, allowedOrigins,
+// expiresAt, realtimeConcurrentSessionLimit, zeroDataRetention, attribution, raw
+
+// Read claims WITHOUT verifying — no network, no crypto. Untrusted: display/logging only.
+const untrusted = decodeClientToken(token);
+```
+
+The JWKS comes from `https://platform.decart.ai/api/auth/jwks` (the platform
+host, not `baseUrl`) and is cached; the JWT library is loaded lazily so bundles
+that never verify do not ship it. Errors: `TOKEN_INVALID`, `TOKEN_EXPIRED`,
+`TOKEN_VERIFY_ERROR` (JWKS unreachable). Options: `{ jwksUrl, issuer, audience,
+clockTolerance }`. This is an offline check, not an API call. It needs WebCrypto: on
+runtimes without it (React Native) `verify` rejects with `UNSUPPORTED_PLATFORM_FEATURE`;
+`decodeClientToken` works everywhere.
+
 ### React Native / Expo
 
 React Native realtime requires [LiveKit's React Native packages](https://github.com/livekit/client-sdk-react-native)

package/dist/create-client.js

@@ -175,7 +175,7 @@ const createDecartClientForPlatform = (createRealtime, options = {}) => {
 		*/
 		queue,
 		/**
-		* Client for creating client tokens.
+		* Client for creating, verifying and decoding client tokens.
 		* Client tokens are short-lived API keys safe for client-side use.
 		*
 		* @example
@@ -183,7 +183,11 @@ const createDecartClientForPlatform = (createRealtime, options = {}) => {
 		* // Server-side: Create a client token
 		* const serverClient = createDecartClient({ apiKey: process.env.DECART_API_KEY });
 		* const token = await serverClient.tokens.create();
-		* // Returns: { apiKey: "ek_...", expiresAt: "2024-12-15T12:10:00Z" }
+		* // Returns: { apiKey: "ek_...", token: "eyJ...", expiresAt: "2024-12-15T12:10:00Z" }
+		*
+		* // Server-side: Verify a client token offline (JWKS) and read its claims
+		* const claims = await serverClient.tokens.verify(token.token);
+		* console.log(claims.serviceTier, claims.pool, claims.organizationId);
 		*
 		* // Client-side: Use the client token
 		* const client = createDecartClient({ apiKey: token.apiKey });

package/dist/index.d.ts

@@ -17,6 +17,8 @@ import { Events, RealTimeClient, RealTimeClientConnectOptions, RealTimeClientIni
 import { CheckConnectivityOptions, ConnectivityMetrics, ConnectivityReport, ConnectivityTransport } from "./realtime/preflight-types.js";
 import { RealTimeSubscribeClient, SubscribeEvents, SubscribeOptions } from "./realtime/subscribe-client.js";
 import { ModelState } from "./shared/types.js";
+import { ClientTokenClaims, decodeClientToken } from "./tokens/claims.js";
+import { VerifyClientTokenOptions, verifyClientToken } from "./tokens/verify.js";
 import { CreateTokenOptions, CreateTokenResponse, TokensClient } from "./tokens/client.js";
 import { DecartClientOptions } from "./create-client.js";
 
@@ -33,4 +35,4 @@ declare const createDecartClient: (options?: DecartClientOptions) => {
   files: FilesClient;
 };
 //#endregion
-export { CanonicalModel, CheckConnectivityOptions, ClientSessionConnectionBreakdownEvent, ClientSessionConnectionBreakdownPhase, ConnectionQuality, ConnectionQualityLimitingFactor, ConnectionQualityMetrics, ConnectionQualityReport, ConnectionState, ConnectivityMetrics, ConnectivityReport, ConnectivityTransport, CreateTokenOptions, CreateTokenResponse, CustomModelDefinition, type DecartClientOptions, DecartSDKError, DiagnosticEvent, DiagnosticEventName, DiagnosticEvents, ERROR_CODES, FileInput, FileReference, FileUploadInput, FilesClient, G2GMetrics, GenerationEndedMessage, ImageModelDefinition, ImageModels, JobStatus, JobStatusResponse, JobSubmitResponse, ListedModelDefinition, LogLevel, Logger, Model, ModelDefinition, ModelFps, ModelKind, ModelState, ProcessClient, ProcessOptions, QueueClient, QueueJobResult, QueuePosition, QueuePositionMessage, QueueSubmitAndPollOptions, QueueSubmitOptions, ReactNativeFile, RealTimeClient, RealTimeClientConnectOptions, RealTimeClientInitialState, Events as RealTimeEvents, RealTimeModels, RealTimeSubscribeClient, RealtimeMediaStream, RealtimeSpeed, ReconnectEvent, SessionEnded, SetInput, SubscribeEvents, SubscribeOptions, TokensClient, UploadFileOptions, VideoModelDefinition, VideoModels, VideoStallEvent, WebRTCStats, createConsoleLogger, createDecartClient, isCanonicalModel, isImageModel, isModel, isRealtimeModel, isVideoModel, listModels, modelAliases, models, noopLogger, resolveCanonicalModelAlias, resolveFpsNumber, resolveModelAlias };
+export { CanonicalModel, CheckConnectivityOptions, ClientSessionConnectionBreakdownEvent, ClientSessionConnectionBreakdownPhase, ClientTokenClaims, ConnectionQuality, ConnectionQualityLimitingFactor, ConnectionQualityMetrics, ConnectionQualityReport, ConnectionState, ConnectivityMetrics, ConnectivityReport, ConnectivityTransport, CreateTokenOptions, CreateTokenResponse, CustomModelDefinition, type DecartClientOptions, DecartSDKError, DiagnosticEvent, DiagnosticEventName, DiagnosticEvents, ERROR_CODES, FileInput, FileReference, FileUploadInput, FilesClient, G2GMetrics, GenerationEndedMessage, ImageModelDefinition, ImageModels, JobStatus, JobStatusResponse, JobSubmitResponse, ListedModelDefinition, LogLevel, Logger, Model, ModelDefinition, ModelFps, ModelKind, ModelState, ProcessClient, ProcessOptions, QueueClient, QueueJobResult, QueuePosition, QueuePositionMessage, QueueSubmitAndPollOptions, QueueSubmitOptions, ReactNativeFile, RealTimeClient, RealTimeClientConnectOptions, RealTimeClientInitialState, Events as RealTimeEvents, RealTimeModels, RealTimeSubscribeClient, RealtimeMediaStream, RealtimeSpeed, ReconnectEvent, SessionEnded, SetInput, SubscribeEvents, SubscribeOptions, TokensClient, UploadFileOptions, VerifyClientTokenOptions, VideoModelDefinition, VideoModels, VideoStallEvent, WebRTCStats, createConsoleLogger, createDecartClient, decodeClientToken, isCanonicalModel, isImageModel, isModel, isRealtimeModel, isVideoModel, listModels, modelAliases, models, noopLogger, resolveCanonicalModelAlias, resolveFpsNumber, resolveModelAlias, verifyClientToken };

package/dist/index.js

@@ -1,4 +1,6 @@
 import { ERROR_CODES } from "./utils/errors.js";
+import { decodeClientToken } from "./tokens/claims.js";
+import { verifyClientToken } from "./tokens/verify.js";
 import { createConsoleLogger, noopLogger } from "./utils/logger.js";
 import { createDecartClientForPlatform } from "./create-client.js";
 import { isCanonicalModel, isImageModel, isModel, isRealtimeModel, isVideoModel, listModels, modelAliases, models, resolveCanonicalModelAlias, resolveFpsNumber, resolveModelAlias } from "./shared/model.js";
@@ -6,4 +8,4 @@ import { createBrowserRealtime } from "./realtime/browser/index.js";
 //#region src/index.ts
 const createDecartClient = (options = {}) => createDecartClientForPlatform(createBrowserRealtime, options);
 //#endregion
-export { ERROR_CODES, createConsoleLogger, createDecartClient, isCanonicalModel, isImageModel, isModel, isRealtimeModel, isVideoModel, listModels, modelAliases, models, noopLogger, resolveCanonicalModelAlias, resolveFpsNumber, resolveModelAlias };
+export { ERROR_CODES, createConsoleLogger, createDecartClient, decodeClientToken, isCanonicalModel, isImageModel, isModel, isRealtimeModel, isVideoModel, listModels, modelAliases, models, noopLogger, resolveCanonicalModelAlias, resolveFpsNumber, resolveModelAlias, verifyClientToken };

package/dist/index.react-native.d.ts

@@ -17,6 +17,8 @@ import { Events, RealTimeClient, RealTimeClientConnectOptions, RealTimeClientIni
 import { CheckConnectivityOptions, ConnectivityMetrics, ConnectivityReport, ConnectivityTransport } from "./realtime/preflight-types.js";
 import { RealTimeSubscribeClient, SubscribeEvents, SubscribeOptions } from "./realtime/subscribe-client.js";
 import { ModelState } from "./shared/types.js";
+import { ClientTokenClaims, decodeClientToken } from "./tokens/claims.js";
+import { VerifyClientTokenOptions, verifyClientToken } from "./tokens/verify.js";
 import { CreateTokenOptions, CreateTokenResponse, TokensClient } from "./tokens/client.js";
 import { DecartClientOptions } from "./create-client.js";
 
@@ -33,4 +35,4 @@ declare const createDecartClient: (options?: DecartClientOptions) => {
   files: FilesClient;
 };
 //#endregion
-export { CanonicalModel, CheckConnectivityOptions, ClientSessionConnectionBreakdownEvent, ClientSessionConnectionBreakdownPhase, ConnectionQuality, ConnectionQualityLimitingFactor, ConnectionQualityMetrics, ConnectionQualityReport, ConnectionState, ConnectivityMetrics, ConnectivityReport, ConnectivityTransport, CreateTokenOptions, CreateTokenResponse, CustomModelDefinition, type DecartClientOptions, DecartSDKError, DiagnosticEvent, DiagnosticEventName, DiagnosticEvents, ERROR_CODES, FileInput, FileReference, FileUploadInput, FilesClient, G2GMetrics, GenerationEndedMessage, ImageModelDefinition, ImageModels, JobStatus, JobStatusResponse, JobSubmitResponse, ListedModelDefinition, LogLevel, Logger, Model, ModelDefinition, ModelFps, ModelKind, ModelState, ProcessClient, ProcessOptions, QueueClient, QueueJobResult, QueuePosition, QueuePositionMessage, QueueSubmitAndPollOptions, QueueSubmitOptions, ReactNativeFile, RealTimeClient, RealTimeClientConnectOptions, RealTimeClientInitialState, Events as RealTimeEvents, RealTimeModels, RealTimeSubscribeClient, RealtimeMediaStream, RealtimeSpeed, ReconnectEvent, SessionEnded, SetInput, SubscribeEvents, SubscribeOptions, TokensClient, UploadFileOptions, VideoModelDefinition, VideoModels, VideoStallEvent, WebRTCStats, createConsoleLogger, createDecartClient, isCanonicalModel, isImageModel, isModel, isRealtimeModel, isVideoModel, listModels, modelAliases, models, noopLogger, resolveCanonicalModelAlias, resolveFpsNumber, resolveModelAlias };
+export { CanonicalModel, CheckConnectivityOptions, ClientSessionConnectionBreakdownEvent, ClientSessionConnectionBreakdownPhase, ClientTokenClaims, ConnectionQuality, ConnectionQualityLimitingFactor, ConnectionQualityMetrics, ConnectionQualityReport, ConnectionState, ConnectivityMetrics, ConnectivityReport, ConnectivityTransport, CreateTokenOptions, CreateTokenResponse, CustomModelDefinition, type DecartClientOptions, DecartSDKError, DiagnosticEvent, DiagnosticEventName, DiagnosticEvents, ERROR_CODES, FileInput, FileReference, FileUploadInput, FilesClient, G2GMetrics, GenerationEndedMessage, ImageModelDefinition, ImageModels, JobStatus, JobStatusResponse, JobSubmitResponse, ListedModelDefinition, LogLevel, Logger, Model, ModelDefinition, ModelFps, ModelKind, ModelState, ProcessClient, ProcessOptions, QueueClient, QueueJobResult, QueuePosition, QueuePositionMessage, QueueSubmitAndPollOptions, QueueSubmitOptions, ReactNativeFile, RealTimeClient, RealTimeClientConnectOptions, RealTimeClientInitialState, Events as RealTimeEvents, RealTimeModels, RealTimeSubscribeClient, RealtimeMediaStream, RealtimeSpeed, ReconnectEvent, SessionEnded, SetInput, SubscribeEvents, SubscribeOptions, TokensClient, UploadFileOptions, VerifyClientTokenOptions, VideoModelDefinition, VideoModels, VideoStallEvent, WebRTCStats, createConsoleLogger, createDecartClient, decodeClientToken, isCanonicalModel, isImageModel, isModel, isRealtimeModel, isVideoModel, listModels, modelAliases, models, noopLogger, resolveCanonicalModelAlias, resolveFpsNumber, resolveModelAlias, verifyClientToken };

package/dist/index.react-native.js

@@ -1,4 +1,6 @@
 import { ERROR_CODES } from "./utils/errors.js";
+import { decodeClientToken } from "./tokens/claims.js";
+import { verifyClientToken } from "./tokens/verify.js";
 import { createConsoleLogger, noopLogger } from "./utils/logger.js";
 import { createDecartClientForPlatform } from "./create-client.js";
 import { isCanonicalModel, isImageModel, isModel, isRealtimeModel, isVideoModel, listModels, modelAliases, models, resolveCanonicalModelAlias, resolveFpsNumber, resolveModelAlias } from "./shared/model.js";
@@ -6,4 +8,4 @@ import { createReactNativeRealtime } from "./realtime/react-native/index.js";
 //#region src/index.react-native.ts
 const createDecartClient = (options = {}) => createDecartClientForPlatform(createReactNativeRealtime, options);
 //#endregion
-export { ERROR_CODES, createConsoleLogger, createDecartClient, isCanonicalModel, isImageModel, isModel, isRealtimeModel, isVideoModel, listModels, modelAliases, models, noopLogger, resolveCanonicalModelAlias, resolveFpsNumber, resolveModelAlias };
+export { ERROR_CODES, createConsoleLogger, createDecartClient, decodeClientToken, isCanonicalModel, isImageModel, isModel, isRealtimeModel, isVideoModel, listModels, modelAliases, models, noopLogger, resolveCanonicalModelAlias, resolveFpsNumber, resolveModelAlias, verifyClientToken };

package/dist/package.js

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.2.2";
+var version = "0.2.3";
 //#endregion
 export { version };

package/dist/tokens/claims.d.ts

@@ -0,0 +1,44 @@
+import { Model } from "../shared/model.js";
+
+//#region src/tokens/claims.d.ts
+
+/**
+ * Client-token claims mapped to SDK names. Trusted when returned by `verifyClientToken` /
+ * `client.tokens.verify`; UNTRUSTED when returned by `decodeClientToken` / `client.tokens.decode`.
+ */
+type ClientTokenClaims = {
+  /** `metadata.service_tier` at mint time (`0` is the free tier); `null` when unset. */
+  serviceTier: number | null;
+  /** `"free"` when `serviceTier` is `0`, otherwise `"paid"`. */
+  pool: "free" | "paid";
+  /** `sub` — the owning user (the organization owner for org tokens). */
+  userId: string;
+  organizationId: string | null;
+  apiKeyName: string | null;
+  /** Parent permanent key id when present, else the ephemeral key's own id (`jti`). */
+  apiKeyId: string | null;
+  /** `null` = unrestricted. */
+  allowedModels: (Model | (string & {}))[] | null;
+  /** `null` = unrestricted. */
+  allowedOrigins: string[] | null;
+  /** ISO 8601, like `CreateTokenResponse.expiresAt`. */
+  expiresAt: string;
+  /** `null` when the owning key is exempt from the limit. */
+  realtimeConcurrentSessionLimit: number | null;
+  zeroDataRetention: boolean;
+  attribution: Record<string, string> | null;
+  /** The full JWT payload, for anything not mapped above. */
+  raw: Record<string, unknown>;
+};
+/** JOSE header prefix plus three segments; opaque `ek_*` / `dct_*` keys never match. */
+
+/**
+ * Read a client token's claims WITHOUT verifying it — no network, no crypto, so it works everywhere
+ * including React Native. The result is UNTRUSTED: use it for display or logging, never for
+ * authorization (use `verifyClientToken` / `client.tokens.verify` for that).
+ *
+ * @throws `TOKEN_INVALID` when the string is not a JWT or the payload is malformed.
+ */
+declare function decodeClientToken(token: string): ClientTokenClaims;
+//#endregion
+export { ClientTokenClaims, decodeClientToken };

package/dist/tokens/claims.js

@@ -0,0 +1,53 @@
+import { ERROR_CODES, createSDKError } from "../utils/errors.js";
+//#region src/tokens/claims.ts
+/** JOSE header prefix plus three segments; opaque `ek_*` / `dct_*` keys never match. */
+const isClientTokenJwt = (credential) => typeof credential === "string" && credential.startsWith("eyJ") && credential.split(".").length === 3;
+const invalid = (message, data) => createSDKError(ERROR_CODES.TOKEN_INVALID, `Invalid client token: ${message}`, data);
+/** An integer (not a boolean) or an integer string, else `null`. */
+const parseServiceTier = (raw) => typeof raw === "number" && Number.isInteger(raw) ? raw : typeof raw === "string" && /^\s*[+-]?\d+\s*$/.test(raw) ? Number.parseInt(raw, 10) : null;
+const str = (value) => typeof value === "string" ? value : null;
+const strArray = (value) => Array.isArray(value) && value.every((item) => typeof item === "string") ? value : null;
+/** Map a raw JWT payload to {@link ClientTokenClaims}. Requires `sub` and `exp`. */
+function mapClientTokenClaims(raw) {
+	if (typeof raw.sub !== "string" || !raw.sub) throw invalid("missing `sub` claim", { claim: "sub" });
+	if (typeof raw.exp !== "number") throw invalid("missing `exp` claim", { claim: "exp" });
+	const serviceTier = parseServiceTier(raw.service_tier) ?? (raw.priority ? 3 : null);
+	const attribution = raw.attribution;
+	return {
+		serviceTier,
+		pool: serviceTier === 0 ? "free" : "paid",
+		userId: raw.sub,
+		organizationId: str(raw.organizationId),
+		apiKeyName: str(raw.api_key_name),
+		apiKeyId: str(raw.parent_api_key_id) ?? str(raw.jti),
+		allowedModels: strArray(raw.models),
+		allowedOrigins: strArray(raw.origins),
+		expiresAt: (/* @__PURE__ */ new Date(raw.exp * 1e3)).toISOString(),
+		realtimeConcurrentSessionLimit: typeof raw.realtimeConcurrentSessionLimit === "number" ? raw.realtimeConcurrentSessionLimit : null,
+		zeroDataRetention: raw.zeroDataRetention === true,
+		attribution: typeof attribution === "object" && attribution !== null && !Array.isArray(attribution) ? attribution : null,
+		raw
+	};
+}
+/**
+* Read a client token's claims WITHOUT verifying it — no network, no crypto, so it works everywhere
+* including React Native. The result is UNTRUSTED: use it for display or logging, never for
+* authorization (use `verifyClientToken` / `client.tokens.verify` for that).
+*
+* @throws `TOKEN_INVALID` when the string is not a JWT or the payload is malformed.
+*/
+function decodeClientToken(token) {
+	if (!isClientTokenJwt(token)) throw invalid("not a JWT", { reason: "malformed" });
+	let payload;
+	try {
+		const base64 = token.split(".")[1].replace(/-/g, "+").replace(/_/g, "/");
+		const utf8 = atob(base64).replace(/[\s\S]/g, (c) => `%${c.charCodeAt(0).toString(16).padStart(2, "0")}`);
+		payload = JSON.parse(decodeURIComponent(utf8));
+	} catch {
+		throw invalid("payload is not base64url JSON", { reason: "malformed" });
+	}
+	if (typeof payload !== "object" || payload === null || Array.isArray(payload)) throw invalid("payload is not a JSON object", { reason: "malformed" });
+	return mapClientTokenClaims(payload);
+}
+//#endregion
+export { decodeClientToken, isClientTokenJwt, mapClientTokenClaims };

package/dist/tokens/client.d.ts

@@ -1,4 +1,6 @@
 import { Model } from "../shared/model.js";
+import { ClientTokenClaims } from "./claims.js";
+import { VerifyClientTokenOptions } from "./verify.js";
 
 //#region src/tokens/client.d.ts
 
@@ -25,7 +27,7 @@ type CreateTokenOptions = {
 };
 type CreateTokenResponse = {
   apiKey: string;
-  /** Signed JWT mirroring `apiKey`, verifiable offline via the public JWKS. */
+  /** Signed JWT mirroring `apiKey`, verifiable offline via `client.tokens.verify` / `verifyClientToken`. */
   token?: string;
   expiresAt: string;
   /** Present when `allowedModels` and/or `allowedOrigins` were set on the request. */
@@ -65,6 +67,17 @@ type TokensClient = {
    * ```
    */
   create: (options?: CreateTokenOptions) => Promise<CreateTokenResponse>;
+  /**
+   * Verify a client token's JWT OFFLINE against the platform's public JWKS (cached) and return its
+   * claims — signature (EdDSA), `exp`, `iss`, `aud`. Same as the standalone `verifyClientToken`;
+   * does not use the client's API key or `baseUrl`.
+   */
+  verify: (token: string, options?: VerifyClientTokenOptions) => Promise<ClientTokenClaims>;
+  /**
+   * Read a client token's claims WITHOUT verifying — no network, no crypto. UNTRUSTED: display or
+   * logging only. Same as the standalone `decodeClientToken`.
+   */
+  decode: (token: string) => ClientTokenClaims;
 };
 //#endregion
 export { CreateTokenOptions, CreateTokenResponse, TokensClient };

package/dist/tokens/client.js

@@ -1,5 +1,7 @@
 import { createSDKError } from "../utils/errors.js";
 import { buildAuthHeaders } from "../shared/request.js";
+import { decodeClientToken } from "./claims.js";
+import { verifyClientToken } from "./verify.js";
 //#region src/tokens/client.ts
 const createTokensClient = (opts) => {
 	const { baseUrl, apiKey, integration } = opts;
@@ -22,7 +24,11 @@ const createTokensClient = (opts) => {
 		}
 		return response.json();
 	};
-	return { create };
+	return {
+		create,
+		verify: verifyClientToken,
+		decode: decodeClientToken
+	};
 };
 //#endregion
 export { createTokensClient };

package/dist/tokens/verify.d.ts

@@ -0,0 +1,26 @@
+import { ClientTokenClaims } from "./claims.js";
+
+//#region src/tokens/verify.d.ts
+type VerifyClientTokenOptions = {
+  /** Default `https://platform.decart.ai/api/auth/jwks`. */
+  jwksUrl?: string;
+  /** Expected `iss`. Default `https://platform.decart.ai`. */
+  issuer?: string;
+  /** Expected `aud`. Default `https://platform.decart.ai`. */
+  audience?: string;
+  /** Allowed clock skew in seconds for `exp`. Default 60. */
+  clockTolerance?: number;
+};
+/**
+ * Verify a Decart client token OFFLINE and return its claims: EdDSA signature against the
+ * platform's public JWKS (fetched once and cached), plus `exp` (with clock tolerance), `iss` and
+ * `aud`. This is a local JWKS check, not an API call, and it needs no API key. Requires WebCrypto and `fetch` (Node 20+, Bun, Deno, browsers, Workers, Edge).
+ *
+ * @throws `TOKEN_INVALID` bad signature, wrong `iss`/`aud`, malformed token or unknown `kid`
+ * @throws `TOKEN_EXPIRED` `exp` is in the past
+ * @throws `TOKEN_VERIFY_ERROR` the JWKS could not be fetched — the token itself was not judged
+ * @throws `UNSUPPORTED_PLATFORM_FEATURE` the runtime has no WebCrypto (e.g. React Native)
+ */
+declare function verifyClientToken(token: string, options?: VerifyClientTokenOptions): Promise<ClientTokenClaims>;
+//#endregion
+export { VerifyClientTokenOptions, verifyClientToken };

package/dist/tokens/verify.js

@@ -0,0 +1,53 @@
+import { ERROR_CODES, createSDKError } from "../utils/errors.js";
+import { isClientTokenJwt, mapClientTokenClaims } from "./claims.js";
+//#region src/tokens/verify.ts
+const PLATFORM_URL = "https://platform.decart.ai";
+let jose;
+const jwkSets = /* @__PURE__ */ new Map();
+/**
+* Verify a Decart client token OFFLINE and return its claims: EdDSA signature against the
+* platform's public JWKS (fetched once and cached), plus `exp` (with clock tolerance), `iss` and
+* `aud`. This is a local JWKS check, not an API call, and it needs no API key. Requires WebCrypto and `fetch` (Node 20+, Bun, Deno, browsers, Workers, Edge).
+*
+* @throws `TOKEN_INVALID` bad signature, wrong `iss`/`aud`, malformed token or unknown `kid`
+* @throws `TOKEN_EXPIRED` `exp` is in the past
+* @throws `TOKEN_VERIFY_ERROR` the JWKS could not be fetched — the token itself was not judged
+* @throws `UNSUPPORTED_PLATFORM_FEATURE` the runtime has no WebCrypto (e.g. React Native)
+*/
+async function verifyClientToken(token, options = {}) {
+	if (!isClientTokenJwt(token)) throw createSDKError(ERROR_CODES.TOKEN_INVALID, "Invalid client token: not a JWT", { reason: "malformed" });
+	if (!globalThis.crypto?.subtle) throw createSDKError(ERROR_CODES.UNSUPPORTED_PLATFORM_FEATURE, "verifyClientToken needs WebCrypto (crypto.subtle), which this runtime does not provide. Verify client tokens on your server; decodeClientToken works everywhere.", { feature: "verifyClientToken" });
+	const jwksUrl = options.jwksUrl ?? `${PLATFORM_URL}/api/auth/jwks`;
+	if (!jose) jose = import("jose");
+	const { jwtVerify, createRemoteJWKSet, errors } = await jose;
+	let jwkSet = jwkSets.get(jwksUrl);
+	if (!jwkSet) {
+		jwkSet = createRemoteJWKSet(new URL(jwksUrl), { cooldownDuration: 6e4 });
+		jwkSets.set(jwksUrl, jwkSet);
+	}
+	try {
+		const { payload } = await jwtVerify(token, jwkSet, {
+			algorithms: ["EdDSA"],
+			issuer: options.issuer ?? PLATFORM_URL,
+			audience: options.audience ?? PLATFORM_URL,
+			clockTolerance: options.clockTolerance ?? 60,
+			requiredClaims: ["exp", "sub"]
+		});
+		return mapClientTokenClaims(payload);
+	} catch (error) {
+		const cause = error instanceof Error ? error : void 0;
+		const { code = "unknown", claim } = cause ?? {};
+		const data = {
+			reason: code,
+			...claim ? { claim } : {}
+		};
+		if (error instanceof errors.JWTExpired) throw createSDKError(ERROR_CODES.TOKEN_EXPIRED, `Client token expired: ${cause?.message}`, data, cause);
+		if (!(!(error instanceof errors.JOSEError) || /^ERR_(JOSE_GENERIC|JWKS_INVALID|JWKS_TIMEOUT)$/.test(code))) throw createSDKError(ERROR_CODES.TOKEN_INVALID, `Invalid client token: ${cause?.message}`, data, cause);
+		throw createSDKError(ERROR_CODES.TOKEN_VERIFY_ERROR, `Could not load the client-token JWKS from ${jwksUrl}: ${cause?.message ?? String(error)}`, {
+			...data,
+			jwksUrl
+		}, cause);
+	}
+}
+//#endregion
+export { verifyClientToken };

package/dist/utils/errors.d.ts

@@ -17,6 +17,12 @@ declare const ERROR_CODES: {
   readonly QUEUE_RESULT_ERROR: "QUEUE_RESULT_ERROR";
   readonly JOB_NOT_COMPLETED: "JOB_NOT_COMPLETED";
   readonly TOKEN_CREATE_ERROR: "TOKEN_CREATE_ERROR";
+  /** Client-token verification: the token is not a valid, correctly signed Decart client token. */
+  readonly TOKEN_INVALID: "TOKEN_INVALID";
+  /** Client-token verification: signature is fine but `exp` is in the past (beyond clock tolerance). */
+  readonly TOKEN_EXPIRED: "TOKEN_EXPIRED";
+  /** Client-token verification could not run, e.g. the JWKS could not be fetched. Says nothing about the token. */
+  readonly TOKEN_VERIFY_ERROR: "TOKEN_VERIFY_ERROR";
   readonly FILES_UPLOAD_ERROR: "FILES_UPLOAD_ERROR";
   readonly FILES_GET_ERROR: "FILES_GET_ERROR";
   readonly FILES_DELETE_ERROR: "FILES_DELETE_ERROR";

package/dist/utils/errors.js

@@ -11,6 +11,12 @@ const ERROR_CODES = {
 	QUEUE_RESULT_ERROR: "QUEUE_RESULT_ERROR",
 	JOB_NOT_COMPLETED: "JOB_NOT_COMPLETED",
 	TOKEN_CREATE_ERROR: "TOKEN_CREATE_ERROR",
+	/** Client-token verification: the token is not a valid, correctly signed Decart client token. */
+	TOKEN_INVALID: "TOKEN_INVALID",
+	/** Client-token verification: signature is fine but `exp` is in the past (beyond clock tolerance). */
+	TOKEN_EXPIRED: "TOKEN_EXPIRED",
+	/** Client-token verification could not run, e.g. the JWKS could not be fetched. Says nothing about the token. */
+	TOKEN_VERIFY_ERROR: "TOKEN_VERIFY_ERROR",
 	FILES_UPLOAD_ERROR: "FILES_UPLOAD_ERROR",
 	FILES_GET_ERROR: "FILES_GET_ERROR",
 	FILES_DELETE_ERROR: "FILES_DELETE_ERROR",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decartai/sdk",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "description": "Decart's JavaScript SDK",
   "type": "module",
   "license": "MIT",
@@ -49,6 +49,7 @@
     "vitest": "^4.0.18"
   },
   "dependencies": {
+    "jose": "^6.2.2",
     "livekit-client": "~2.20.1",
     "mitt": "^3.0.1",
     "p-retry": "^6.2.1",