livekit-server-sdk 2.3.0 → 2.4.0

package/dist/WebhookReceiver.js.map

@@ -1 +1 @@
-{"version":3,"file":"WebhookReceiver.js","sourceRoot":"","sources":["../src/WebhookReceiver.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,IAAI,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjD,MAAM,CAAC,MAAM,eAAe,GAAG,WAAW,CAAC;AAE3C,MAAM,OAAO,YAAa,SAAQ,iBAAiB;IAAnD;;QACE,UAAK,GAAsB,EAAE,CAAC;IAahC,CAAC;IAXC,MAAM,CAAC,UAAU,CAAC,KAAiB,EAAE,OAAoC;QACvE,OAAO,IAAI,YAAY,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,CAAC,QAAQ,CAAC,SAAoB,EAAE,OAAkC;QACtE,OAAO,IAAI,YAAY,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,CAAC,cAAc,CAAC,UAAkB,EAAE,OAAkC;QAC1E,OAAO,IAAI,YAAY,EAAE,CAAC,cAAc,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAChE,CAAC;CACF;AAoBD,MAAM,OAAO,eAAe;IAG1B,YAAY,MAAc,EAAE,SAAiB;QAC3C,IAAI,CAAC,QAAQ,GAAG,IAAI,aAAa,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACvD,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,OAAO,CACX,IAAY,EACZ,UAAmB,EACnB,WAAoB,KAAK;QAEzB,eAAe;QACf,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;YACnD,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YACtD,cAAc;YACd,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;YAClC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YACzE,MAAM,WAAW,GAAG,IAAI,CACtB,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;iBAC7B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;iBAClC,IAAI,CAAC,EAAE,CAAC,CACZ,CAAC;YAEF,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;gBAClC,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;QAED,OAAO,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;IAChF,CAAC;CACF"}
+{"version":3,"file":"WebhookReceiver.js","sourceRoot":"","sources":["../src/WebhookReceiver.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,YAAY,IAAI,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjD,MAAM,CAAC,MAAM,eAAe,GAAG,WAAW,CAAC;AAE3C,MAAM,OAAO,YAAa,SAAQ,iBAAiB;IAAnD;;QACE,UAAK,GAAsB,EAAE,CAAC;IAahC,CAAC;IAXC,MAAM,CAAC,UAAU,CAAC,KAAiB,EAAE,OAAoC;QACvE,OAAO,IAAI,YAAY,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,CAAC,QAAQ,CAAC,SAAoB,EAAE,OAAkC;QACtE,OAAO,IAAI,YAAY,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,CAAC,cAAc,CAAC,UAAkB,EAAE,OAAkC;QAC1E,OAAO,IAAI,YAAY,EAAE,CAAC,cAAc,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAChE,CAAC;CACF;AAoBD,MAAM,OAAO,eAAe;IAG1B,YAAY,MAAc,EAAE,SAAiB;QAC3C,IAAI,CAAC,QAAQ,GAAG,IAAI,aAAa,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACvD,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,OAAO,CACX,IAAY,EACZ,UAAmB,EACnB,WAAoB,KAAK;QAEzB,eAAe;QACf,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;YACnD,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YACtD,cAAc;YACd,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;YAClC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YACzE,MAAM,WAAW,GAAG,IAAI,CACtB,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;iBAC7B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;iBAClC,IAAI,CAAC,EAAE,CAAC,CACZ,CAAC;YAEF,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;gBAClC,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;QAED,OAAO,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;IAChF,CAAC;CACF"}

package/dist/grants.d.ts

@@ -1,5 +1,5 @@
-import { JWTPayload } from 'jose';
 import { TrackSource } from '@livekit/protocol';
+import { JWTPayload } from 'jose';
 export declare function trackSourceToString(source: TrackSource): "camera" | "microphone" | "screen_share" | "screen_share_audio";
 export declare function claimsToJwtPayload(grant: ClaimGrants): JWTPayload & {
     video?: Record<string, unknown>;
@@ -53,3 +53,4 @@ export interface ClaimGrants extends JWTPayload {
     metadata?: string;
     sha256?: string;
 }
+//# sourceMappingURL=grants.d.ts.map

package/dist/grants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants.d.ts","sourceRoot":"","sources":["../src/grants.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AAElC,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,WAAW,mEAatD;AAED,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,WAAW,GACjB,UAAU,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAOlD;AAED,MAAM,WAAW,UAAU;IACzB,kCAAkC;IAClC,UAAU,CAAC,EAAE,OAAO,CAAC;IAErB,mEAAmE;IACnE,QAAQ,CAAC,EAAE,OAAO,CAAC;IAEnB,+BAA+B;IAC/B,QAAQ,CAAC,EAAE,OAAO,CAAC;IAEnB,sCAAsC;IACtC,UAAU,CAAC,EAAE,OAAO,CAAC;IAErB,8DAA8D;IAC9D,SAAS,CAAC,EAAE,OAAO,CAAC;IAEpB,kEAAkE;IAClE,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd,0EAA0E;IAC1E,YAAY,CAAC,EAAE,OAAO,CAAC;IAEvB;;;OAGG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IAErB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,WAAW,EAAE,CAAC;IAElC,qDAAqD;IACrD,YAAY,CAAC,EAAE,OAAO,CAAC;IAEvB;;OAEG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IAEzB;;OAEG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAE/B,0CAA0C;IAC1C,MAAM,CAAC,EAAE,OAAO,CAAC;IAEjB,+FAA+F;IAC/F,QAAQ,CAAC,EAAE,OAAO,CAAC;IAEnB,8DAA8D;IAC9D,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,gBAAgB;AAChB,MAAM,WAAW,WAAY,SAAQ,UAAU;IAC7C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB"}

package/dist/grants.js

@@ -1,3 +1,6 @@
+// SPDX-FileCopyrightText: 2024 LiveKit, Inc.
+//
+// SPDX-License-Identifier: Apache-2.0
 import { TrackSource } from '@livekit/protocol';
 export function trackSourceToString(source) {
     switch (source) {

package/dist/grants.js.map

@@ -1 +1 @@
-{"version":3,"file":"grants.js","sourceRoot":"","sources":["../src/grants.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,MAAM,UAAU,mBAAmB,CAAC,MAAmB;IACrD,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,WAAW,CAAC,MAAM;YACrB,OAAO,QAAQ,CAAC;QAClB,KAAK,WAAW,CAAC,UAAU;YACzB,OAAO,YAAY,CAAC;QACtB,KAAK,WAAW,CAAC,YAAY;YAC3B,OAAO,cAAc,CAAC;QACxB,KAAK,WAAW,CAAC,kBAAkB;YACjC,OAAO,oBAAoB,CAAC;QAC9B;YACE,MAAM,IAAI,SAAS,CAAC,8BAA8B,MAAM,YAAY,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,KAAkB;;IAElB,MAAM,KAAK,qBAA6B,KAAK,CAAE,CAAC;IAChD,gDAAgD;IAChD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAA,KAAK,CAAC,KAAK,0CAAE,iBAAiB,CAAC,EAAE,CAAC;QAClD,KAAK,CAAC,KAAK,CAAC,iBAAiB,GAAG,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"grants.js","sourceRoot":"","sources":["../src/grants.ts"],"names":[],"mappings":"AAAA,6CAA6C;AAC7C,EAAE;AACF,sCAAsC;AACtC,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGhD,MAAM,UAAU,mBAAmB,CAAC,MAAmB;IACrD,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,WAAW,CAAC,MAAM;YACrB,OAAO,QAAQ,CAAC;QAClB,KAAK,WAAW,CAAC,UAAU;YACzB,OAAO,YAAY,CAAC;QACtB,KAAK,WAAW,CAAC,YAAY;YAC3B,OAAO,cAAc,CAAC;QACxB,KAAK,WAAW,CAAC,kBAAkB;YACjC,OAAO,oBAAoB,CAAC;QAC9B;YACE,MAAM,IAAI,SAAS,CAAC,8BAA8B,MAAM,YAAY,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,KAAkB;;IAElB,MAAM,KAAK,qBAA6B,KAAK,CAAE,CAAC;IAChD,gDAAgD;IAChD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAA,KAAK,CAAC,KAAK,0CAAE,iBAAiB,CAAC,EAAE,CAAC;QAClD,KAAK,CAAC,KAAK,CAAC,iBAAiB,GAAG,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/index.d.ts

@@ -6,3 +6,4 @@ export * from './RoomServiceClient.js';
 export * from './WebhookReceiver.js';
 export * from './grants.js';
 export { AliOSSUpload, AzureBlobUpload, DirectFileOutput, EgressInfo, EncodedFileOutput, EncodedFileType, EncodingOptions, EncodingOptionsPreset, GCPUpload, ImageOutput, ParticipantEgressRequest, RoomCompositeEgressRequest, S3Upload, SegmentedFileOutput, SegmentedFileProtocol, StreamOutput, StreamProtocol, TrackCompositeEgressRequest, TrackEgressRequest, WebEgressRequest, IngressAudioEncodingOptions, IngressAudioEncodingPreset, IngressAudioOptions, IngressInfo, IngressInput, IngressState, IngressVideoEncodingOptions, IngressVideoEncodingPreset, IngressVideoOptions, DataPacket_Kind, ParticipantInfo, ParticipantInfo_State, ParticipantPermission, Room, TrackInfo, TrackType, TrackSource, SIPTrunkInfo, SIPDispatchRuleInfo, SIPParticipantInfo, } from '@livekit/protocol';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,wBAAwB,CAAC;AACvC,cAAc,sBAAsB,CAAC;AACrC,cAAc,aAAa,CAAC;AAC5B,OAAO,EACL,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,UAAU,EACV,iBAAiB,EACjB,eAAe,EACf,eAAe,EACf,qBAAqB,EACrB,SAAS,EACT,WAAW,EACX,wBAAwB,EACxB,0BAA0B,EAC1B,QAAQ,EACR,mBAAmB,EACnB,qBAAqB,EACrB,YAAY,EACZ,cAAc,EACd,2BAA2B,EAC3B,kBAAkB,EAClB,gBAAgB,EAChB,2BAA2B,EAC3B,0BAA0B,EAC1B,mBAAmB,EACnB,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,2BAA2B,EAC3B,0BAA0B,EAC1B,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,qBAAqB,EACrB,qBAAqB,EACrB,IAAI,EACJ,SAAS,EACT,SAAS,EACT,WAAW,EACX,YAAY,EACZ,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC"}

package/dist/index.js

@@ -1,3 +1,6 @@
+// SPDX-FileCopyrightText: 2024 LiveKit, Inc.
+//
+// SPDX-License-Identifier: Apache-2.0
 export * from './AccessToken.js';
 export * from './EgressClient.js';
 export * from './IngressClient.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,wBAAwB,CAAC;AACvC,cAAc,sBAAsB,CAAC;AACrC,cAAc,aAAa,CAAC;AAC5B,OAAO,EACL,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,UAAU,EACV,iBAAiB,EACjB,eAAe,EACf,eAAe,EACf,qBAAqB,EACrB,SAAS,EACT,WAAW,EACX,wBAAwB,EACxB,0BAA0B,EAC1B,QAAQ,EACR,mBAAmB,EACnB,qBAAqB,EACrB,YAAY,EACZ,cAAc,EACd,2BAA2B,EAC3B,kBAAkB,EAClB,gBAAgB,EAChB,2BAA2B,EAC3B,0BAA0B,EAC1B,mBAAmB,EACnB,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,2BAA2B,EAC3B,0BAA0B,EAC1B,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,qBAAqB,EACrB,qBAAqB,EACrB,IAAI,EACJ,SAAS,EACT,SAAS,EACT,WAAW,EACX,YAAY,EACZ,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,6CAA6C;AAC7C,EAAE;AACF,sCAAsC;AAEtC,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,wBAAwB,CAAC;AACvC,cAAc,sBAAsB,CAAC;AACrC,cAAc,aAAa,CAAC;AAC5B,OAAO,EACL,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,UAAU,EACV,iBAAiB,EACjB,eAAe,EACf,eAAe,EACf,qBAAqB,EACrB,SAAS,EACT,WAAW,EACX,wBAAwB,EACxB,0BAA0B,EAC1B,QAAQ,EACR,mBAAmB,EACnB,qBAAqB,EACrB,YAAY,EACZ,cAAc,EACd,2BAA2B,EAC3B,kBAAkB,EAClB,gBAAgB,EAChB,2BAA2B,EAC3B,0BAA0B,EAC1B,mBAAmB,EACnB,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,2BAA2B,EAC3B,0BAA0B,EAC1B,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,qBAAqB,EACrB,qBAAqB,EACrB,IAAI,EACJ,SAAS,EACT,SAAS,EACT,WAAW,EACX,YAAY,EACZ,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "livekit-server-sdk",
-  "version": "2.3.0",
+  "version": "2.4.0",
   "description": "Server-side SDK for LiveKit",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -8,6 +8,10 @@
   "author": "David Zhao <david@davidzhao.com>",
   "license": "Apache-2.0",
   "type": "module",
+  "files": [
+    "dist",
+    "src"
+  ],
   "dependencies": {
     "@livekit/protocol": "^1.14.0",
     "camelcase-keys": "^9.0.0",

package/src/AccessToken.test.ts

@@ -0,0 +1,96 @@
+// SPDX-FileCopyrightText: 2024 LiveKit, Inc.
+//
+// SPDX-License-Identifier: Apache-2.0
+import * as jose from 'jose';
+import { describe, expect, it } from 'vitest';
+import { AccessToken, TokenVerifier } from './AccessToken';
+import { ClaimGrants } from './grants';
+
+const testApiKey = 'abcdefg';
+const testSecret = 'abababa';
+
+describe('encoded tokens are valid', () => {
+  const t = new AccessToken(testApiKey, testSecret, {
+    identity: 'me',
+    name: 'myname',
+  });
+  t.addGrant({ room: 'myroom' });
+  const EncodedTestSecret = new TextEncoder().encode(testSecret);
+  it('can be decoded', async () => {
+    const { payload } = await jose.jwtVerify(await t.toJwt(), EncodedTestSecret, {
+      issuer: testApiKey,
+    });
+
+    expect(payload).not.toBe(undefined);
+  });
+
+  it('has name set', async () => {
+    const { payload } = await jose.jwtVerify(await t.toJwt(), EncodedTestSecret, {
+      issuer: testApiKey,
+    });
+
+    expect(payload.name).toBe('myname');
+  });
+
+  it('has video grants set', async () => {
+    const { payload } = await jose.jwtVerify(await t.toJwt(), EncodedTestSecret, {
+      issuer: testApiKey,
+    });
+
+    expect(payload.video).toBeTruthy();
+    expect((payload as ClaimGrants).video?.room).toEqual('myroom');
+  });
+});
+
+describe('identity is required for only join grants', () => {
+  it('allows empty identity for create', async () => {
+    const t = new AccessToken(testApiKey, testSecret);
+    t.addGrant({ roomCreate: true });
+
+    expect(await t.toJwt()).toBeTruthy();
+  });
+  it('throws error when identity is not provided for join', async () => {
+    const t = new AccessToken(testApiKey, testSecret);
+    t.addGrant({ roomJoin: true });
+
+    await expect(async () => {
+      await t.toJwt();
+    }).rejects.toThrow();
+  });
+});
+
+describe('verify token is valid', () => {
+  it('can decode encoded token', async () => {
+    const t = new AccessToken(testApiKey, testSecret);
+    t.sha256 = 'abcdefg';
+    t.addGrant({ roomCreate: true });
+
+    const v = new TokenVerifier(testApiKey, testSecret);
+    const decoded = await v.verify(await t.toJwt());
+
+    expect(decoded).not.toBe(undefined);
+    expect(decoded.sha256).toEqual('abcdefg');
+    expect(decoded.video?.roomCreate).toBeTruthy();
+  });
+});
+
+describe('adding grants should not overwrite existing grants', () => {
+  const EncodedTestSecret = new TextEncoder().encode(testSecret);
+
+  it('should not overwrite existing grants', async () => {
+    const t = new AccessToken(testApiKey, testSecret, {
+      identity: 'me',
+      name: 'myname',
+    });
+    t.addGrant({ roomCreate: true });
+    t.addGrant({ roomJoin: true });
+
+    const { payload }: jose.JWTVerifyResult<ClaimGrants> = await jose.jwtVerify(
+      await t.toJwt(),
+      EncodedTestSecret,
+      { issuer: testApiKey },
+    );
+    expect(payload.video?.roomCreate).toBeTruthy();
+    expect(payload.video?.roomJoin).toBeTruthy();
+  });
+});

package/src/AccessToken.ts

@@ -0,0 +1,151 @@
+// SPDX-FileCopyrightText: 2024 LiveKit, Inc.
+//
+// SPDX-License-Identifier: Apache-2.0
+import * as jose from 'jose';
+import { ClaimGrants, VideoGrant, claimsToJwtPayload } from './grants.js';
+
+// 6 hours
+const defaultTTL = `6h`;
+
+export interface AccessTokenOptions {
+  /**
+   * amount of time before expiration
+   * expressed in seconds or a string describing a time span zeit/ms.
+   * eg: '2 days', '10h', or seconds as numeric value
+   */
+  ttl?: number | string;
+
+  /**
+   * display name for the participant, available as `Participant.name`
+   */
+  name?: string;
+
+  /**
+   * identity of the user, required for room join tokens
+   */
+  identity?: string;
+
+  /**
+   * custom metadata to be passed to participants
+   */
+  metadata?: string;
+}
+
+export class AccessToken {
+  private apiKey: string;
+
+  private apiSecret: string;
+
+  private grants: ClaimGrants;
+
+  identity?: string;
+
+  ttl: number | string;
+
+  /**
+   * Creates a new AccessToken
+   * @param apiKey API Key, can be set in env LIVEKIT_API_KEY
+   * @param apiSecret Secret, can be set in env LIVEKIT_API_SECRET
+   */
+  constructor(apiKey?: string, apiSecret?: string, options?: AccessTokenOptions) {
+    if (!apiKey) {
+      apiKey = process.env.LIVEKIT_API_KEY;
+    }
+    if (!apiSecret) {
+      apiSecret = process.env.LIVEKIT_API_SECRET;
+    }
+    if (!apiKey || !apiSecret) {
+      throw Error('api-key and api-secret must be set');
+    } else if (typeof document !== 'undefined') {
+      // check against document rather than window because deno provides window
+      console.error(
+        'You should not include your API secret in your web client bundle.\n\n' +
+          'Your web client should request a token from your backend server which should then use ' +
+          'the API secret to generate a token. See https://docs.livekit.io/client/connect/',
+      );
+    }
+    this.apiKey = apiKey;
+    this.apiSecret = apiSecret;
+    this.grants = {};
+    this.identity = options?.identity;
+    this.ttl = options?.ttl || defaultTTL;
+    if (typeof this.ttl === 'number') {
+      this.ttl = `${this.ttl}s`;
+    }
+    if (options?.metadata) {
+      this.metadata = options.metadata;
+    }
+    if (options?.name) {
+      this.name = options.name;
+    }
+  }
+
+  /**
+   * Adds a video grant to this token.
+   * @param grant
+   */
+  addGrant(grant: VideoGrant) {
+    this.grants.video = { ...(this.grants.video ?? {}), ...grant };
+  }
+
+  /**
+   * Set metadata to be passed to the Participant, used only when joining the room
+   */
+  set metadata(md: string) {
+    this.grants.metadata = md;
+  }
+
+  set name(name: string) {
+    this.grants.name = name;
+  }
+
+  get sha256(): string | undefined {
+    return this.grants.sha256;
+  }
+
+  set sha256(sha: string | undefined) {
+    this.grants.sha256 = sha;
+  }
+
+  /**
+   * @returns JWT encoded token
+   */
+  async toJwt(): Promise<string> {
+    // TODO: check for video grant validity
+
+    const secret = new TextEncoder().encode(this.apiSecret);
+
+    const jwt = new jose.SignJWT(claimsToJwtPayload(this.grants))
+      .setProtectedHeader({ alg: 'HS256' })
+      .setIssuer(this.apiKey)
+      .setExpirationTime(this.ttl)
+      .setNotBefore(0);
+    if (this.identity) {
+      jwt.setSubject(this.identity);
+    } else if (this.grants.video?.roomJoin) {
+      throw Error('identity is required for join but not set');
+    }
+    return jwt.sign(secret);
+  }
+}
+
+export class TokenVerifier {
+  private apiKey: string;
+
+  private apiSecret: string;
+
+  constructor(apiKey: string, apiSecret: string) {
+    this.apiKey = apiKey;
+    this.apiSecret = apiSecret;
+  }
+
+  async verify(token: string): Promise<ClaimGrants> {
+    const secret = new TextEncoder().encode(this.apiSecret);
+    const { payload } = await jose.jwtVerify(token, secret, { issuer: this.apiKey });
+    if (!payload) {
+      throw Error('invalid token');
+    }
+
+    return payload as ClaimGrants;
+  }
+}