@fonoster/common 0.27.0 → 0.31.0

package/dist/filters/index.js

@@ -0,0 +1,101 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AudioFilterConfigError = exports.audioFilterConfigSchema = exports.FILTER_NAMES = exports.FILTER_BY_PROVIDER = exports.FILTER_SCHEMAS = exports.aiCousticsPublicOptionsSchema = exports.AI_COUSTICS_FILTER = void 0;
+exports.providerOfFilter = providerOfFilter;
+exports.parseFilters = parseFilters;
+/**
+ * Copyright (C) 2025 by Fonoster Inc (https://fonoster.com)
+ * http://github.com/fonoster/fonoster
+ *
+ * This file is part of Fonoster
+ *
+ * Licensed under the MIT License (the "License");
+ * you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ *    https://opensource.org/licenses/MIT
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+const zod_1 = require("zod");
+/**
+ * The audio filters an app may configure (voice-session, "An app's audio filters are set through
+ * the Applications API"). Apps are untrusted input, so each filter exposes a public option schema
+ * here, shared by the apiserver (validation on write) and the appbridge (the filter factory).
+ * Anything that touches the media server's filesystem, environment or credentials stays out.
+ */
+exports.AI_COUSTICS_FILTER = "aiCoustics";
+/** The ai-coustics filter's public options. */
+exports.aiCousticsPublicOptionsSchema = zod_1.z
+    .object({
+    // The vendor's model id; restricted to its shape so it cannot name a path
+    model: zod_1.z
+        .string()
+        .regex(/^[a-z0-9]+(-[a-z0-9.]+)*$/, { message: "Invalid model name" })
+        .default("quail-vf-2.2-s-16khz"),
+    // Higher values suppress more, competing speech included
+    enhancementLevel: zod_1.z.number().min(0).max(1).default(1),
+    // Keeps the delay but stops enhancing (for A/B tests)
+    bypass: zod_1.z.boolean().default(false)
+})
+    // Reject anything else outright, so a server-only option (or a key) is refused, not ignored
+    .strict();
+/** Public option schemas by filter name. */
+exports.FILTER_SCHEMAS = {
+    [exports.AI_COUSTICS_FILTER]: exports.aiCousticsPublicOptionsSchema
+};
+/** The filter a noise-cancelling (`nc`) provider runs, by provider id. */
+exports.FILTER_BY_PROVIDER = {
+    aicoustics: exports.AI_COUSTICS_FILTER
+};
+exports.FILTER_NAMES = Object.keys(exports.FILTER_SCHEMAS);
+/** The `nc` provider whose credential a filter runs with, or undefined for a filter without one. */
+function providerOfFilter(name) {
+    var _a;
+    return (_a = Object.entries(exports.FILTER_BY_PROVIDER).find(([, f]) => f === name)) === null || _a === void 0 ? void 0 : _a[0];
+}
+exports.audioFilterConfigSchema = zod_1.z
+    .object({
+    name: zod_1.z.string().min(1),
+    options: zod_1.z.record(zod_1.z.unknown()).optional()
+})
+    .strict();
+class AudioFilterConfigError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "AudioFilterConfigError";
+    }
+}
+exports.AudioFilterConfigError = AudioFilterConfigError;
+/**
+ * Validates an app's `filters` list: known names and public options only. Returns the list with
+ * each filter's options as given (defaults are applied by the filter itself). Throws
+ * AudioFilterConfigError naming the first offending filter or option.
+ */
+function parseFilters(input) {
+    const list = zod_1.z.array(exports.audioFilterConfigSchema).safeParse(input);
+    if (!list.success) {
+        throw new AudioFilterConfigError(`filters must be a list of { name, options? }: ${issues(list.error)}`);
+    }
+    return list.data.map((f) => {
+        var _a;
+        const schema = exports.FILTER_SCHEMAS[f.name];
+        if (!schema) {
+            throw new AudioFilterConfigError(`unknown audio filter "${f.name}" (known: ${exports.FILTER_NAMES.join(", ")})`);
+        }
+        const parsed = schema.safeParse((_a = f.options) !== null && _a !== void 0 ? _a : {});
+        if (!parsed.success) {
+            throw new AudioFilterConfigError(`invalid options for audio filter "${f.name}": ${issues(parsed.error)}`);
+        }
+        return f.options ? { name: f.name, options: f.options } : { name: f.name };
+    });
+}
+function issues(error) {
+    return error.issues
+        .map((i) => i.path.length ? `${i.path.join(".")}: ${i.message}` : i.message)
+        .join("; ");
+}

package/dist/identity/createAuthInterceptor.d.ts

@@ -1,15 +1,22 @@
 import { ServerInterceptingCall } from "@grpc/grpc-js";
+import { TokenVerifyOptions } from "./isValidToken";
 /**
  * This function is a gRPC interceptor that checks if the request is valid
  * and if the user has the right permissions to access the resource. When
  * validating the request, the function will check if the request is in the
- * skip list, if the token is valid and if the role is allowed by the RBAC.
+ * skip list, if the token is a valid access token (RS256, unexpired,
+ * `tokenUse: "access"`, and the pinned issuer and audience when given) and if
+ * the caller's role in the target workspace is allowed by the RBAC.
+ *
+ * It fails closed: any error while checking a request answers
+ * UNAUTHENTICATED instead of reaching the handler or throwing.
  *
  * @param {string} identityPublicKey - The public key to validate the token
  * @param {string[]} publicPath - The list of public paths
+ * @param {TokenVerifyOptions} options - Issuer and audience to pin
  * @return {Function} - The gRPC interceptor
  */
-declare function createAuthInterceptor(identityPublicKey: string, publicPath: string[]): (methodDefinition: {
+declare function createAuthInterceptor(identityPublicKey: string, publicPath: string[], options?: TokenVerifyOptions): (methodDefinition: {
     path: string;
 }, call: ServerInterceptingCall) => ServerInterceptingCall;
 export { createAuthInterceptor };

package/dist/identity/createAuthInterceptor.js

@@ -20,26 +20,29 @@ exports.createAuthInterceptor = createAuthInterceptor;
  * limitations under the License.
  */
 const logger_1 = require("@fonoster/logger");
-const decodeToken_1 = require("./decodeToken");
 const errors_1 = require("./errors");
 const getAccessKeyIdFromCall_1 = require("./getAccessKeyIdFromCall");
 const getTokenFromCall_1 = require("./getTokenFromCall");
 const hasAccess_1 = require("./hasAccess");
-const isValidToken_1 = require("./isValidToken");
-const roles_1 = require("./roles");
-const tokenHasAccessKeyId_1 = require("./tokenHasAccessKeyId");
+const verifyAccessToken_1 = require("./verifyAccessToken");
 const logger = (0, logger_1.getLogger)({ service: "common", filePath: __filename });
 /**
  * This function is a gRPC interceptor that checks if the request is valid
  * and if the user has the right permissions to access the resource. When
  * validating the request, the function will check if the request is in the
- * skip list, if the token is valid and if the role is allowed by the RBAC.
+ * skip list, if the token is a valid access token (RS256, unexpired,
+ * `tokenUse: "access"`, and the pinned issuer and audience when given) and if
+ * the caller's role in the target workspace is allowed by the RBAC.
+ *
+ * It fails closed: any error while checking a request answers
+ * UNAUTHENTICATED instead of reaching the handler or throwing.
  *
  * @param {string} identityPublicKey - The public key to validate the token
  * @param {string[]} publicPath - The list of public paths
+ * @param {TokenVerifyOptions} options - Issuer and audience to pin
  * @return {Function} - The gRPC interceptor
  */
-function createAuthInterceptor(identityPublicKey, publicPath) {
+function createAuthInterceptor(identityPublicKey, publicPath, options = {}) {
     /**
      * Inner function that will be called by the gRPC server.
      *
@@ -49,33 +52,36 @@ function createAuthInterceptor(identityPublicKey, publicPath) {
      * @return {ServerInterceptingCall} - The modified call object
      */
     return (methodDefinition, call) => {
-        const { path } = methodDefinition;
-        const accessKeyId = (0, getAccessKeyIdFromCall_1.getAccessKeyIdFromCall)(call);
-        logger.verbose("intercepting api call to path", { accessKeyId, path });
-        if (publicPath.includes(methodDefinition.path)) {
-            logger.verbose("passing auth control to edge function", { path });
+        try {
+            const { path } = methodDefinition;
+            const accessKeyId = (0, getAccessKeyIdFromCall_1.getAccessKeyIdFromCall)(call);
+            logger.verbose("intercepting api call to path", { accessKeyId, path });
+            if (publicPath.includes(path)) {
+                logger.verbose("passing auth control to edge function", { path });
+                return call;
+            }
+            logger.verbose("validating token", { accessKeyId, path });
+            const decodedToken = (0, verifyAccessToken_1.verifyAccessToken)((0, getTokenFromCall_1.getTokenFromCall)(call), identityPublicKey, options);
+            if (!decodedToken) {
+                return (0, errors_1.unauthenticatedError)(call);
+            }
+            const allowed = (0, hasAccess_1.hasAccess)(decodedToken, path, accessKeyId);
+            logger.verbose("checking access for accessKeyId", {
+                accessKeyId,
+                path,
+                hasAccess: allowed
+            });
+            if (!allowed) {
+                return (0, errors_1.permissionDeniedError)(call);
+            }
             return call;
         }
-        const token = (0, getTokenFromCall_1.getTokenFromCall)(call);
-        logger.verbose("validating token", { accessKeyId, path });
-        if (!(0, isValidToken_1.isValidToken)(token, identityPublicKey)) {
+        catch (error) {
+            logger.warn("refusing a call that failed the auth check", {
+                path: methodDefinition === null || methodDefinition === void 0 ? void 0 : methodDefinition.path,
+                error: error === null || error === void 0 ? void 0 : error.message
+            });
             return (0, errors_1.unauthenticatedError)(call);
         }
-        const decodedToken = (0, decodeToken_1.decodeToken)(token);
-        logger.verbose("checking access for accessKeyId", {
-            accessKeyId,
-            path,
-            hasAccess: (0, hasAccess_1.hasAccess)(decodedToken, path),
-            pathIsWorkspacePath: roles_1.workspaceResourceAccess.includes(path),
-            tokenHasAccessKeyId: (0, tokenHasAccessKeyId_1.tokenHasAccessKeyId)(token, accessKeyId)
-        });
-        if (!(0, hasAccess_1.hasAccess)(decodedToken, path) ||
-            (roles_1.workspaceResourceAccess.includes(path) &&
-                !(0, tokenHasAccessKeyId_1.tokenHasAccessKeyId)(token, accessKeyId)) ||
-            (roles_1.workspaceResourceOwnerOrAdminAccess.includes(path) &&
-                !(0, tokenHasAccessKeyId_1.tokenHasAccessKeyId)(token, accessKeyId))) {
-            return (0, errors_1.permissionDeniedError)(call);
-        }
-        return call;
     };
 }

package/dist/identity/hasAccess.d.ts

@@ -1,6 +1,12 @@
 import { Access } from "./types";
+/**
+ * Whether the token's roles allow the gRPC method. For a workspace method only
+ * the caller's role in the target workspace (`targetAccessKeyId`) counts, never
+ * a role held in another workspace; without a matching entry it is refused.
+ * Malformed claims are refused rather than thrown on.
+ */
 declare function hasAccess(decodedToken: {
-    access: Access[];
-    accessKeyId: string;
-}, method: string): boolean;
+    access?: Access[];
+    accessKeyId?: string;
+}, method: string, targetAccessKeyId?: string): boolean;
 export { hasAccess };

package/dist/identity/hasAccess.js

@@ -21,12 +21,36 @@ exports.hasAccess = hasAccess;
  */
 const types_1 = require("@fonoster/types");
 const roles_1 = require("./roles");
-// This function only checks if the role has access to the grpc method
-function hasAccess(decodedToken, method) {
-    const { access, accessKeyId } = decodedToken;
-    const roleList = accessKeyId.startsWith("US") && // US is for user; user tokens only have USER role
-        access.length === 0 // If it is a user token, and has no access, we still allow it in case it is a user method
-        ? [types_1.Role.USER]
-        : access.map((a) => a.role);
-    return roleList.some((r) => roles_1.roles.find((role) => role.name === r && role.access.includes(method)));
+/** Methods that act inside one workspace, named by the request's accessKeyId. */
+const isWorkspaceMethod = (method) => roles_1.workspaceResourceAccess.includes(method) ||
+    roles_1.workspaceResourceOwnerOrAdminAccess.includes(method);
+const roleAllows = (roleName, method) => roles_1.roles.some((role) => role.name === roleName && role.access.includes(method));
+/**
+ * Whether the token's roles allow the gRPC method. For a workspace method only
+ * the caller's role in the target workspace (`targetAccessKeyId`) counts, never
+ * a role held in another workspace; without a matching entry it is refused.
+ * Malformed claims are refused rather than thrown on.
+ */
+function hasAccess(decodedToken, method, targetAccessKeyId) {
+    const access = Array.isArray(decodedToken === null || decodedToken === void 0 ? void 0 : decodedToken.access)
+        ? decodedToken.access.filter((a) => a && typeof a.role === "string" && typeof a.accessKeyId === "string")
+        : [];
+    const accessKeyId = typeof (decodedToken === null || decodedToken === void 0 ? void 0 : decodedToken.accessKeyId) === "string"
+        ? decodedToken.accessKeyId
+        : "";
+    if (isWorkspaceMethod(method)) {
+        if (!targetAccessKeyId) {
+            return false;
+        }
+        const entry = access.find((a) => a.accessKeyId === targetAccessKeyId);
+        return entry ? roleAllows(entry.role, method) : false;
+    }
+    // User tokens (accessKeyId "US…") always carry the USER role, so methods
+    // about the user themselves (e.g. UpdateUser, CreateWorkspace) keep working
+    // once they belong to a workspace. Their workspace roles add to it.
+    const workspaceRoles = access.map((a) => a.role);
+    const roleList = accessKeyId.startsWith("US")
+        ? [types_1.Role.USER, ...workspaceRoles]
+        : workspaceRoles;
+    return roleList.some((r) => roleAllows(r, method));
 }

package/dist/identity/index.d.ts

@@ -23,5 +23,6 @@ export * from "./getAccessKeyIdFromCall";
 export * from "./getTokenFromCall";
 export * from "./hasAccess";
 export * from "./isValidToken";
+export * from "./verifyAccessToken";
 export * from "./types";
 export * from "./roles";

package/dist/identity/index.js

@@ -39,5 +39,6 @@ __exportStar(require("./getAccessKeyIdFromCall"), exports);
 __exportStar(require("./getTokenFromCall"), exports);
 __exportStar(require("./hasAccess"), exports);
 __exportStar(require("./isValidToken"), exports);
+__exportStar(require("./verifyAccessToken"), exports);
 __exportStar(require("./types"), exports);
 __exportStar(require("./roles"), exports);

package/dist/identity/isValidToken.d.ts

@@ -1,2 +1,12 @@
-declare function isValidToken(token: string, secret: string): boolean;
-export { isValidToken };
+import jwt from "jsonwebtoken";
+/** Identity signs every token with RS256; nothing else is accepted. */
+declare const IDENTITY_SIGN_ALGORITHMS: jwt.Algorithm[];
+/** Claims to pin when verifying; each one is checked only when given. */
+type TokenVerifyOptions = {
+    issuer?: string;
+    audience?: string;
+};
+/** The verified claims, or undefined when the signature, expiry or claims don't check out. */
+declare function verifyToken(token: string, secret: string, options?: TokenVerifyOptions): Record<string, unknown> | undefined;
+declare function isValidToken(token: string, secret: string, options?: TokenVerifyOptions): boolean;
+export { IDENTITY_SIGN_ALGORITHMS, isValidToken, TokenVerifyOptions, verifyToken };

package/dist/identity/isValidToken.js

@@ -3,7 +3,9 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.IDENTITY_SIGN_ALGORITHMS = void 0;
 exports.isValidToken = isValidToken;
+exports.verifyToken = verifyToken;
 /**
  * Copyright (C) 2025 by Fonoster Inc (https://fonoster.com)
  * http://github.com/fonoster/fonoster
@@ -26,26 +28,40 @@ const logger_1 = require("@fonoster/logger");
 const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
 const types_1 = require("./types");
 const logger = (0, logger_1.getLogger)({ service: "identity", filePath: __filename });
-function isValidToken(token, secret) {
+/** Identity signs every token with RS256; nothing else is accepted. */
+const IDENTITY_SIGN_ALGORITHMS = ["RS256"];
+exports.IDENTITY_SIGN_ALGORITHMS = IDENTITY_SIGN_ALGORITHMS;
+/** The verified claims, or undefined when the signature, expiry or claims don't check out. */
+function verifyToken(token, secret, options = {}) {
+    if (!token || typeof token !== "string") {
+        return undefined;
+    }
     try {
-        const decoded = jsonwebtoken_1.default.verify(token, secret);
+        const decoded = jsonwebtoken_1.default.verify(token, secret, Object.assign(Object.assign({ algorithms: IDENTITY_SIGN_ALGORITHMS }, (options.issuer ? { issuer: options.issuer } : {})), (options.audience ? { audience: options.audience } : {})));
+        if (!decoded || typeof decoded !== "object") {
+            return undefined;
+        }
+        const { exp } = decoded;
         const currentTime = Math.floor(Date.now() / 1000);
-        if (decoded.exp <= currentTime) {
-            logger.verbose("token expired", { exp: decoded.exp, currentTime });
-            return false;
+        if (typeof exp !== "number" || exp <= currentTime) {
+            logger.verbose("token expired or without expiry", { exp, currentTime });
+            return undefined;
         }
-        return true;
+        return decoded;
     }
     catch (error) {
         if (error.name === types_1.JsonWebErrorEnum.JsonWebTokenError) {
-            logger.verbose("invalid JWT token", { token });
+            logger.verbose("invalid JWT token");
         }
         else if (error.name === types_1.JsonWebErrorEnum.TokenExpiredError) {
-            logger.verbose("token expired", { token });
+            logger.verbose("token expired");
         }
         else {
             logger.verbose("unexpected JWT error:", error);
         }
-        return false;
+        return undefined;
     }
 }
+function isValidToken(token, secret, options = {}) {
+    return verifyToken(token, secret, options) !== undefined;
+}

package/dist/identity/roles.js

@@ -30,6 +30,18 @@ const workspaceResourceAccess = [
     "/fonoster.applications.v1beta2.Applications/DeleteApplication",
     "/fonoster.applications.v1beta2.Applications/ListApplications",
     "/fonoster.applications.v1beta2.Applications/EvaluateIntelligence",
+    "/fonoster.applications.v1beta2.Applications/RotateSigningSecret",
+    "/fonoster.webhooks.v1beta2.Webhooks/CreateWebhook",
+    "/fonoster.webhooks.v1beta2.Webhooks/ListWebhooks",
+    "/fonoster.webhooks.v1beta2.Webhooks/GetWebhook",
+    "/fonoster.webhooks.v1beta2.Webhooks/UpdateWebhook",
+    "/fonoster.webhooks.v1beta2.Webhooks/DeleteWebhook",
+    "/fonoster.webhooks.v1beta2.Webhooks/RotateWebhookSecret",
+    "/fonoster.webhooks.v1beta2.Webhooks/ListWebhookDeliveries",
+    "/fonoster.webhooks.v1beta2.Webhooks/ResendWebhookDelivery",
+    "/fonoster.providers.v1beta2.Providers/ListCatalog",
+    "/fonoster.providers.v1beta2.Providers/ListProviderKeys",
+    "/fonoster.providers.v1beta2.Providers/ListWarnings",
     "/fonoster.agents.v1beta2.Agents/CreateAgent",
     "/fonoster.agents.v1beta2.Agents/UpdateAgent",
     "/fonoster.agents.v1beta2.Agents/GetAgent",
@@ -65,24 +77,37 @@ const workspaceResourceAccess = [
     "/fonoster.secrets.v1beta2.Secrets/GetSecret",
     "/fonoster.secrets.v1beta2.Secrets/DeleteSecret",
     "/fonoster.secrets.v1beta2.Secrets/ListSecrets",
+    "/fonoster.usage.v1beta2.Usage/GetUsage",
     "/fonoster.calls.v1beta2.Calls/CreateCall",
     "/fonoster.calls.v1beta2.Calls/ListCalls",
     "/fonoster.calls.v1beta2.Calls/GetCall",
     "/fonoster.calls.v1beta2.Calls/TrackCall",
-    "/fonoster.voice.v1beta2.Voice/CreateSession",
-    "/fonoster.identity.v1beta2.Identity/CreateApiKey",
-    "/fonoster.identity.v1beta2.Identity/DeleteApiKey",
-    "/fonoster.identity.v1beta2.Identity/ListApiKeys",
-    "/fonoster.identity.v1beta2.Identity/RegenerateApiKey"
+    "/fonoster.voice.v1beta2.Voice/CreateSession"
 ];
 exports.workspaceResourceAccess = workspaceResourceAccess;
 const workspaceResourceOwnerOrAdminAccess = [
+    // Bring-your-own vendor keys (add-provider-registry P1): owners and admins only.
+    "/fonoster.providers.v1beta2.Providers/SetProviderKey",
+    "/fonoster.providers.v1beta2.Providers/DeleteProviderKey",
     "/fonoster.identity.v1beta2.Identity/ListWorkspaceMembers",
     "/fonoster.identity.v1beta2.Identity/InviteUserToWorkspace",
     "/fonoster.identity.v1beta2.Identity/RemoveUserFromWorkspace",
-    "/fonoster.identity.v1beta2.Identity/ResendWorkspaceMembershipInvitation"
+    "/fonoster.identity.v1beta2.Identity/ResendWorkspaceMembershipInvitation",
+    // API keys act with WORKSPACE_ADMIN rights, so only owners and admins manage them.
+    "/fonoster.identity.v1beta2.Identity/CreateApiKey",
+    "/fonoster.identity.v1beta2.Identity/DeleteApiKey",
+    "/fonoster.identity.v1beta2.Identity/ListApiKeys",
+    "/fonoster.identity.v1beta2.Identity/RegenerateApiKey"
 ];
 exports.workspaceResourceOwnerOrAdminAccess = workspaceResourceOwnerOrAdminAccess;
+// Billing belongs to the owner (add-billing-service): only owners see or change it.
+const workspaceOwnerAccess = [
+    "/fonoster.billing.v1beta2.Billing/GetBilling",
+    "/fonoster.billing.v1beta2.Billing/UpdateAutoRecharge",
+    "/fonoster.billing.v1beta2.Billing/CreateTopUp",
+    "/fonoster.billing.v1beta2.Billing/Subscribe",
+    "/fonoster.billing.v1beta2.Billing/CreatePortalSession"
+];
 const fullIdentityAccess = [
     "/fonoster.identity.v1beta2.Identity/GetUser",
     "/fonoster.identity.v1beta2.Identity/UpdateUser",
@@ -106,7 +131,8 @@ const roles = [
         access: [
             ...fullIdentityAccess,
             ...workspaceResourceAccess,
-            ...workspaceResourceOwnerOrAdminAccess
+            ...workspaceResourceOwnerOrAdminAccess,
+            ...workspaceOwnerAccess
         ]
     },
     {

package/dist/identity/types.d.ts

@@ -20,7 +20,8 @@ import { Role } from "@fonoster/types";
 declare enum TokenUseEnum {
     ID = "id",
     ACCESS = "access",
-    REFRESH = "refresh"
+    REFRESH = "refresh",
+    INVITE = "invite"
 }
 declare enum JsonWebErrorEnum {
     JsonWebTokenError = "JsonWebTokenError",
@@ -49,6 +50,8 @@ type IdToken = BaseToken & {
     phoneNumberVerified: boolean;
     phoneNumber: string;
     email: string;
+    /** True while the user holds an invite's one-time password. */
+    mustChangePassword?: boolean;
     tokenUse: TokenUseEnum.ID;
 };
 type AccessToken = BaseToken & {
@@ -57,6 +60,8 @@ type AccessToken = BaseToken & {
 };
 type RefreshToken = BaseToken & {
     tokenUse: TokenUseEnum.REFRESH;
+    /** Unique id, tracked by Identity for rotation and revocation. */
+    jti?: string;
 };
 type DecodedToken<T extends TokenUseEnum> = T extends TokenUseEnum.ID ? IdToken : T extends TokenUseEnum.ACCESS ? AccessToken : T extends TokenUseEnum.REFRESH ? TokenUseEnum : never;
 export { Access, AccessToken, DecodedToken, IdToken, RefreshToken, RoleType, TokenUseEnum, JsonWebErrorEnum };

package/dist/identity/types.js

@@ -6,6 +6,7 @@ var TokenUseEnum;
     TokenUseEnum["ID"] = "id";
     TokenUseEnum["ACCESS"] = "access";
     TokenUseEnum["REFRESH"] = "refresh";
+    TokenUseEnum["INVITE"] = "invite";
 })(TokenUseEnum || (exports.TokenUseEnum = TokenUseEnum = {}));
 var JsonWebErrorEnum;
 (function (JsonWebErrorEnum) {

package/dist/{assistants/LanguageModelProvider.js → identity/verifyAccessToken.d.ts}

@@ -1,6 +1,3 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.LanguageModelProvider = void 0;
 /**
  * Copyright (C) 2025 by Fonoster Inc (https://fonoster.com)
  * http://github.com/fonoster/fonoster
@@ -19,11 +16,13 @@ exports.LanguageModelProvider = void 0;
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-var LanguageModelProvider;
-(function (LanguageModelProvider) {
-    LanguageModelProvider["OPENAI"] = "openai";
-    LanguageModelProvider["GROQ"] = "groq";
-    LanguageModelProvider["OLLAMA"] = "ollama";
-    LanguageModelProvider["GOOGLE"] = "google";
-    LanguageModelProvider["ANTHROPIC"] = "anthropic";
-})(LanguageModelProvider || (exports.LanguageModelProvider = LanguageModelProvider = {}));
+import { TokenVerifyOptions } from "./isValidToken";
+import { AccessToken } from "./types";
+/**
+ * Verifies `token` and returns it only when it is an access token: signed by
+ * Identity (RS256), unexpired, `tokenUse: "access"`, with a string
+ * `accessKeyId` and a well-formed `access` array. Id, refresh, invite and other
+ * signed tokens are refused (undefined), as is anything malformed.
+ */
+declare function verifyAccessToken(token: string, identityPublicKey: string, options?: TokenVerifyOptions): AccessToken | undefined;
+export { verifyAccessToken };

package/dist/identity/verifyAccessToken.js

@@ -0,0 +1,44 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyAccessToken = verifyAccessToken;
+/**
+ * Copyright (C) 2025 by Fonoster Inc (https://fonoster.com)
+ * http://github.com/fonoster/fonoster
+ *
+ * This file is part of Fonoster
+ *
+ * Licensed under the MIT License (the "License");
+ * you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ *    https://opensource.org/licenses/MIT
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+const isValidToken_1 = require("./isValidToken");
+const types_1 = require("./types");
+const isAccessEntry = (entry) => typeof entry === "object" &&
+    entry !== null &&
+    typeof entry.accessKeyId === "string" &&
+    typeof entry.role === "string";
+/**
+ * Verifies `token` and returns it only when it is an access token: signed by
+ * Identity (RS256), unexpired, `tokenUse: "access"`, with a string
+ * `accessKeyId` and a well-formed `access` array. Id, refresh, invite and other
+ * signed tokens are refused (undefined), as is anything malformed.
+ */
+function verifyAccessToken(token, identityPublicKey, options = {}) {
+    const claims = (0, isValidToken_1.verifyToken)(token, identityPublicKey, options);
+    if (!claims ||
+        claims.tokenUse !== types_1.TokenUseEnum.ACCESS ||
+        typeof claims.accessKeyId !== "string" ||
+        !Array.isArray(claims.access) ||
+        !claims.access.every(isAccessEntry)) {
+        return undefined;
+    }
+    return claims;
+}

package/dist/index.d.ts

@@ -16,7 +16,8 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-export * from "./assistants";
+export * from "./agents";
+export * from "./config";
 export * from "./GrpcError";
 export * from "./constants";
 export * from "./errors";
@@ -29,6 +30,18 @@ export * from "./types";
 export * from "./utils";
 export * as Validators from "./validators";
 export * from "./validators";
-export * from "./voice";
+export * from "./calls";
 export * from "./countryIsoCodes";
 export * from "./identity";
+export { getRootDomain, setRootDomain } from "./envs";
+export * from "./session";
+export * as Registry from "./registry";
+export * as AudioFilters from "./filters";
+export * as Webhooks from "./webhooks";
+export * as Usage from "./usage";
+export * as CellSecrets from "./cellsecrets";
+export * from "./telemetry";
+export * from "./net";
+export * as Sessions from "./sessions";
+export * as RegionHub from "./regions/hub";
+export * as Roomr from "./roomr";

package/dist/index.js

@@ -36,7 +36,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.Validators = exports.Messages = void 0;
+exports.Roomr = exports.RegionHub = exports.Sessions = exports.CellSecrets = exports.Usage = exports.Webhooks = exports.AudioFilters = exports.Registry = exports.setRootDomain = exports.getRootDomain = exports.Validators = exports.Messages = void 0;
 /**
  * Copyright (C) 2025 by Fonoster Inc (https://fonoster.com)
  * http://github.com/fonoster/fonoster
@@ -55,7 +55,8 @@ exports.Validators = exports.Messages = void 0;
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-__exportStar(require("./assistants"), exports);
+__exportStar(require("./agents"), exports);
+__exportStar(require("./config"), exports);
 __exportStar(require("./GrpcError"), exports);
 __exportStar(require("./constants"), exports);
 __exportStar(require("./errors"), exports);
@@ -68,6 +69,20 @@ __exportStar(require("./types"), exports);
 __exportStar(require("./utils"), exports);
 exports.Validators = __importStar(require("./validators"));
 __exportStar(require("./validators"), exports);
-__exportStar(require("./voice"), exports);
+__exportStar(require("./calls"), exports);
 __exportStar(require("./countryIsoCodes"), exports);
 __exportStar(require("./identity"), exports);
+var envs_1 = require("./envs");
+Object.defineProperty(exports, "getRootDomain", { enumerable: true, get: function () { return envs_1.getRootDomain; } });
+Object.defineProperty(exports, "setRootDomain", { enumerable: true, get: function () { return envs_1.setRootDomain; } });
+__exportStar(require("./session"), exports);
+exports.Registry = __importStar(require("./registry"));
+exports.AudioFilters = __importStar(require("./filters"));
+exports.Webhooks = __importStar(require("./webhooks"));
+exports.Usage = __importStar(require("./usage"));
+exports.CellSecrets = __importStar(require("./cellsecrets"));
+__exportStar(require("./telemetry"), exports);
+__exportStar(require("./net"), exports);
+exports.Sessions = __importStar(require("./sessions"));
+exports.RegionHub = __importStar(require("./regions/hub"));
+exports.Roomr = __importStar(require("./roomr"));