telnyx 7.29.0 → 7.30.0-beta.0

package/lib/login-token.d.ts

@@ -0,0 +1,87 @@
+/**
+ * WebRTC login tokens minted locally, with no request to Telnyx.
+ *
+ * The token has the same shape as the one
+ * `POST /v2/telephony_credentials/{id}/token` returns, so it is used the same
+ * way: pass it to the WebRTC SDK as `login_token`. Telnyx verifies it on login.
+ * It is the same computation as `TelephonyCredential#to_jwt` in telnyx-ruby.
+ *
+ * The signing material comes from the credential: `token_material` is in the
+ * response of `POST /v2/telephony_credentials` and of
+ * `GET /v2/telephony_credentials/{id}/token_material`. It is as sensitive as
+ * the SIP password, so keep it on the server; never ship it to a browser.
+ *
+ * @example
+ * const { data: credential } = await client.telephonyCredentials.create({
+ *   connection_id: '123',
+ *   include: 'token_material',   // the API returns the material only when asked
+ * });
+ * const loginToken = await client.telephonyCredentials.toJwt(credential);          // 1 hour
+ * const shortLived = await client.telephonyCredentials.toJwt(credential, { ttl: 600 });
+ *
+ * To mint later with no request at all, store these with the user the credential
+ * belongs to, server side: `id`, `user_id`, `sip_username`, `expires_at` and
+ * `token_material`. The token is built from all of them.
+ *
+ * @example From stored values, without a request at all
+ * import { createLoginToken } from 'telnyx/lib/login-token';
+ * const loginToken = await createLoginToken({
+ *   id: '...', user_id: '...', sip_username: 'gencred...', expires_at: '2027-01-01T00:00:00Z',
+ *   token_material: { kid: 'v1', tel_token: '...', signing_secret: '...' },
+ * });
+ */
+import { TelnyxError } from "../core/error.js";
+/** Token lifetime when `ttl` is not given: one hour. */
+export declare const LOGIN_TOKEN_DEFAULT_TTL = 3600;
+/** Longest lifetime a login token can have: one day, the same as API-minted tokens. */
+export declare const LOGIN_TOKEN_MAX_TTL = 86400;
+/** `cty` header of a locally minted token; voice-sdk-proxy selects the verification path by it. */
+export declare const LOGIN_TOKEN_CONTENT_TYPE = "telnyx-webrtc;v=1";
+/**
+ * What the API returns as `token_material`. `signing_secret` is base64url
+ * (unpadded) bytes of the HS256 key; `tel_token` goes into the token as is.
+ */
+export interface TokenMaterial {
+    /** Which key the material was derived with (`v1` today). Goes in the JWT header. */
+    kid: string;
+    /** The SIP credential encrypted for the gateway, the same value `/token` puts in the `tel_token` claim. */
+    tel_token: string;
+    /** The HS256 key the token is signed with, base64url. */
+    signing_secret: string;
+}
+/** The fields of a telephony credential that a login token is built from. */
+export interface LoginTokenCredential {
+    /** The telephony credential `id`. */
+    id?: string | undefined;
+    /** The credential's `user_id`. */
+    user_id?: string | undefined;
+    /** The credential's `sip_username`; the token's `identity`. */
+    sip_username?: string | undefined;
+    /** The credential's `expires_at`, as the API returns it, or null. */
+    expires_at?: string | null | undefined;
+    /** `kid`, `tel_token`, `signing_secret`; present on a credential from `create`. */
+    token_material?: TokenMaterial | undefined;
+}
+export interface LoginTokenOptions {
+    /** Token lifetime in seconds, 1..86400. Default one hour. */
+    ttl?: number | undefined;
+    /** Signing material to use instead of `credential.token_material`. */
+    tokenMaterial?: TokenMaterial | undefined;
+    /** The token's issue time; defaults to now. */
+    now?: Date | number | undefined;
+}
+export declare class TelnyxLoginTokenError extends TelnyxError {
+    constructor(message: string);
+}
+/**
+ * Mints a login token for `credential`, valid from `now` for `ttl` seconds.
+ * Pure computation: HMAC-SHA256 over the token with `token_material.signing_secret`.
+ */
+export declare function createLoginToken(credential: LoginTokenCredential, options?: LoginTokenOptions): Promise<string>;
+/**
+ * Checks a token minted by `createLoginToken` against `signingSecret` and
+ * returns its claims. For tests and debugging: Telnyx does the real
+ * verification on login.
+ */
+export declare function decodeLoginToken(jwt: string, signingSecret: string): Promise<Record<string, unknown>>;
+//# sourceMappingURL=login-token.d.ts.map

package/lib/login-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-token.d.ts","sourceRoot":"","sources":["../src/lib/login-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,WAAW,EAAE,yBAAsB;AAI5C,wDAAwD;AACxD,eAAO,MAAM,uBAAuB,OAAO,CAAC;AAC5C,uFAAuF;AACvF,eAAO,MAAM,mBAAmB,QAAQ,CAAC;AACzC,mGAAmG;AACnG,eAAO,MAAM,wBAAwB,sBAAsB,CAAC;AAE5D;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,oFAAoF;IACpF,GAAG,EAAE,MAAM,CAAC;IACZ,2GAA2G;IAC3G,SAAS,EAAE,MAAM,CAAC;IAClB,yDAAyD;IACzD,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,6EAA6E;AAC7E,MAAM,WAAW,oBAAoB;IACnC,qCAAqC;IACrC,EAAE,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxB,kCAAkC;IAClC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,+DAA+D;IAC/D,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,qEAAqE;IACrE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACvC,mFAAmF;IACnF,cAAc,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;CAC5C;AAED,MAAM,WAAW,iBAAiB;IAChC,6DAA6D;IAC7D,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,sEAAsE;IACtE,aAAa,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;IAC1C,+CAA+C;IAC/C,GAAG,CAAC,EAAE,IAAI,GAAG,MAAM,GAAG,SAAS,CAAC;CACjC;AAED,qBAAa,qBAAsB,SAAQ,WAAW;gBACxC,OAAO,EAAE,MAAM;CAI5B;AAED;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,UAAU,EAAE,oBAAoB,EAChC,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,MAAM,CAAC,CAyBjB;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAW3G"}

package/lib/login-token.js

@@ -0,0 +1,190 @@
+"use strict";
+/**
+ * WebRTC login tokens minted locally, with no request to Telnyx.
+ *
+ * The token has the same shape as the one
+ * `POST /v2/telephony_credentials/{id}/token` returns, so it is used the same
+ * way: pass it to the WebRTC SDK as `login_token`. Telnyx verifies it on login.
+ * It is the same computation as `TelephonyCredential#to_jwt` in telnyx-ruby.
+ *
+ * The signing material comes from the credential: `token_material` is in the
+ * response of `POST /v2/telephony_credentials` and of
+ * `GET /v2/telephony_credentials/{id}/token_material`. It is as sensitive as
+ * the SIP password, so keep it on the server; never ship it to a browser.
+ *
+ * @example
+ * const { data: credential } = await client.telephonyCredentials.create({
+ *   connection_id: '123',
+ *   include: 'token_material',   // the API returns the material only when asked
+ * });
+ * const loginToken = await client.telephonyCredentials.toJwt(credential);          // 1 hour
+ * const shortLived = await client.telephonyCredentials.toJwt(credential, { ttl: 600 });
+ *
+ * To mint later with no request at all, store these with the user the credential
+ * belongs to, server side: `id`, `user_id`, `sip_username`, `expires_at` and
+ * `token_material`. The token is built from all of them.
+ *
+ * @example From stored values, without a request at all
+ * import { createLoginToken } from 'telnyx/lib/login-token';
+ * const loginToken = await createLoginToken({
+ *   id: '...', user_id: '...', sip_username: 'gencred...', expires_at: '2027-01-01T00:00:00Z',
+ *   token_material: { kid: 'v1', tel_token: '...', signing_secret: '...' },
+ * });
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TelnyxLoginTokenError = exports.LOGIN_TOKEN_CONTENT_TYPE = exports.LOGIN_TOKEN_MAX_TTL = exports.LOGIN_TOKEN_DEFAULT_TTL = void 0;
+exports.createLoginToken = createLoginToken;
+exports.decodeLoginToken = decodeLoginToken;
+const error_1 = require("../core/error.js");
+const base64_1 = require("../internal/utils/base64.js");
+const bytes_1 = require("../internal/utils/bytes.js");
+/** Token lifetime when `ttl` is not given: one hour. */
+exports.LOGIN_TOKEN_DEFAULT_TTL = 3600;
+/** Longest lifetime a login token can have: one day, the same as API-minted tokens. */
+exports.LOGIN_TOKEN_MAX_TTL = 86400;
+/** `cty` header of a locally minted token; voice-sdk-proxy selects the verification path by it. */
+exports.LOGIN_TOKEN_CONTENT_TYPE = 'telnyx-webrtc;v=1';
+class TelnyxLoginTokenError extends error_1.TelnyxError {
+    constructor(message) {
+        super(message);
+        this.name = 'TelnyxLoginTokenError';
+    }
+}
+exports.TelnyxLoginTokenError = TelnyxLoginTokenError;
+/**
+ * Mints a login token for `credential`, valid from `now` for `ttl` seconds.
+ * Pure computation: HMAC-SHA256 over the token with `token_material.signing_secret`.
+ */
+async function createLoginToken(credential, options = {}) {
+    const credentialId = required(credential.id, 'id');
+    const userId = required(credential.user_id, 'user_id');
+    const identity = required(credential.sip_username, 'sip_username');
+    const material = normalizeMaterial(options.tokenMaterial ?? credential.token_material);
+    const ttl = clampTtl(options.ttl);
+    const now = options.now === undefined ? Date.now() : Number(options.now);
+    const iat = Math.floor(now / 1000);
+    // Same field order as the Ruby SDK, so the two produce the same bytes.
+    const header = { alg: 'HS256', typ: 'JWT', cty: exports.LOGIN_TOKEN_CONTENT_TYPE, kid: material.kid };
+    const payload = {
+        sub: credentialId,
+        user_id: userId,
+        identity,
+        cred_exp: credential.expires_at ?? null,
+        tel_token: material.tel_token,
+        iat,
+        nbf: iat,
+        exp: iat + ttl,
+        jti: `${credentialId}-${iat}`,
+    };
+    const signingInput = `${base64url(JSON.stringify(header))}.${base64url(JSON.stringify(payload))}`;
+    return `${signingInput}.${base64url(await sign(signingInput, material.signing_secret))}`;
+}
+/**
+ * Checks a token minted by `createLoginToken` against `signingSecret` and
+ * returns its claims. For tests and debugging: Telnyx does the real
+ * verification on login.
+ */
+async function decodeLoginToken(jwt, signingSecret) {
+    const [head, body, sig, ...rest] = String(jwt).split('.');
+    if (!head || !body || sig === undefined || rest.length) {
+        throw new TelnyxLoginTokenError('not a JWT');
+    }
+    const expected = await sign(`${head}.${body}`, signingSecret);
+    const given = fromBase64url(sig);
+    if (!bytesEqual(given, expected)) {
+        throw new TelnyxLoginTokenError('Signature is invalid and does not match the payload');
+    }
+    return JSON.parse((0, bytes_1.decodeUTF8)(fromBase64url(body)));
+}
+function required(value, name) {
+    if (value === undefined || value === null || String(value) === '') {
+        throw new TelnyxLoginTokenError(`${name} is required to mint a token`);
+    }
+    return String(value);
+}
+function normalizeMaterial(material) {
+    if (!material || typeof material !== 'object') {
+        throw new TelnyxLoginTokenError('token_material is required to mint a token');
+    }
+    const out = {};
+    for (const field of ['kid', 'tel_token', 'signing_secret']) {
+        const value = material[field];
+        if (value === undefined || value === null || String(value) === '') {
+            throw new TelnyxLoginTokenError(`token_material.${field} is missing`);
+        }
+        out[field] = String(value);
+    }
+    return out;
+}
+function clampTtl(ttl) {
+    const n = ttl === undefined ? exports.LOGIN_TOKEN_DEFAULT_TTL : Math.trunc(Number(ttl));
+    if (!Number.isFinite(n))
+        return exports.LOGIN_TOKEN_DEFAULT_TTL;
+    return Math.min(exports.LOGIN_TOKEN_MAX_TTL, Math.max(1, n));
+}
+function base64url(data) {
+    // Base64 pads with at most two '=': a bounded match keeps this linear on any input.
+    return (0, base64_1.toBase64)(data)
+        .replace(/\+/g, '-')
+        .replace(/\//g, '_')
+        .replace(/={1,2}$/, '');
+}
+function fromBase64url(str) {
+    const b64 = str.replace(/-/g, '+').replace(/_/g, '/');
+    return (0, base64_1.fromBase64)(b64 + '='.repeat((4 - (b64.length % 4)) % 4));
+}
+function bytesEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < a.length; i++)
+        diff |= a[i] ^ b[i];
+    return diff === 0;
+}
+async function getSubtle() {
+    if (typeof globalThis.crypto !== 'undefined' && globalThis.crypto.subtle) {
+        return globalThis.crypto.subtle;
+    }
+    // Node.js < 19 may need webcrypto from crypto module
+    const nodeCrypto = await Promise.resolve().then(() => __importStar(require('crypto')));
+    return nodeCrypto.webcrypto.subtle;
+}
+async function sign(signingInput, signingSecret) {
+    const subtle = await getSubtle();
+    const key = await subtle.importKey('raw', fromBase64url(signingSecret), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+    return new Uint8Array(await subtle.sign('HMAC', key, (0, bytes_1.encodeUTF8)(signingInput)));
+}
+//# sourceMappingURL=login-token.js.map

package/lib/login-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-token.js","sourceRoot":"","sources":["../src/lib/login-token.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4DH,4CA4BC;AAOD,4CAWC;AAxGD,4CAA4C;AAC5C,wDAAgE;AAChE,sDAAiE;AAEjE,wDAAwD;AAC3C,QAAA,uBAAuB,GAAG,IAAI,CAAC;AAC5C,uFAAuF;AAC1E,QAAA,mBAAmB,GAAG,KAAK,CAAC;AACzC,mGAAmG;AACtF,QAAA,wBAAwB,GAAG,mBAAmB,CAAC;AAsC5D,MAAa,qBAAsB,SAAQ,mBAAW;IACpD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AALD,sDAKC;AAED;;;GAGG;AACI,KAAK,UAAU,gBAAgB,CACpC,UAAgC,EAChC,UAA6B,EAAE;IAE/B,MAAM,YAAY,GAAG,QAAQ,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,QAAQ,CAAC,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,QAAQ,CAAC,UAAU,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;IACnE,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,aAAa,IAAI,UAAU,CAAC,cAAc,CAAC,CAAC;IACvF,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACzE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;IAEnC,uEAAuE;IACvE,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,gCAAwB,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC;IAC9F,MAAM,OAAO,GAAG;QACd,GAAG,EAAE,YAAY;QACjB,OAAO,EAAE,MAAM;QACf,QAAQ;QACR,QAAQ,EAAE,UAAU,CAAC,UAAU,IAAI,IAAI;QACvC,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,GAAG;QACH,GAAG,EAAE,GAAG;QACR,GAAG,EAAE,GAAG,GAAG,GAAG;QACd,GAAG,EAAE,GAAG,YAAY,IAAI,GAAG,EAAE;KAC9B,CAAC;IAEF,MAAM,YAAY,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;IAClG,OAAO,GAAG,YAAY,IAAI,SAAS,CAAC,MAAM,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC;AAC3F,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,gBAAgB,CAAC,GAAW,EAAE,aAAqB;IACvE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1D,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,IAAI,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QACvD,MAAM,IAAI,qBAAqB,CAAC,WAAW,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,EAAE,aAAa,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,qBAAqB,CAAC,qDAAqD,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAA,kBAAU,EAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAA4B,CAAC;AAChF,CAAC;AAED,SAAS,QAAQ,CAAC,KAAgC,EAAE,IAAY;IAC9D,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAClE,MAAM,IAAI,qBAAqB,CAAC,GAAG,IAAI,8BAA8B,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,iBAAiB,CAAC,QAA0C;IACnE,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9C,MAAM,IAAI,qBAAqB,CAAC,4CAA4C,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,GAAG,GAAG,EAAyC,CAAC;IACtD,KAAK,MAAM,KAAK,IAAI,CAAC,KAAK,EAAE,WAAW,EAAE,gBAAgB,CAAU,EAAE,CAAC;QACpE,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;YAClE,MAAM,IAAI,qBAAqB,CAAC,kBAAkB,KAAK,aAAa,CAAC,CAAC;QACxE,CAAC;QACD,GAAG,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,QAAQ,CAAC,GAAuB;IACvC,MAAM,CAAC,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,+BAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAChF,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,+BAAuB,CAAC;IACxD,OAAO,IAAI,CAAC,GAAG,CAAC,2BAAmB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,SAAS,CAAC,IAAyB;IAC1C,oFAAoF;IACpF,OAAO,IAAA,iBAAQ,EAAC,IAAI,CAAC;SAClB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACtD,OAAO,IAAA,mBAAU,EAAC,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,UAAU,CAAC,CAAa,EAAE,CAAa;IAC9C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;IACzD,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC;AAcD,KAAK,UAAU,SAAS;IACtB,IAAI,OAAO,UAAU,CAAC,MAAM,KAAK,WAAW,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACzE,OAAO,UAAU,CAAC,MAAM,CAAC,MAAqC,CAAC;IACjE,CAAC;IACD,qDAAqD;IACrD,MAAM,UAAU,GAAG,wDAAa,QAAQ,GAAC,CAAC;IAC1C,OAAQ,UAAU,CAAC,SAAqD,CAAC,MAAM,CAAC;AAClF,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,YAAoB,EAAE,aAAqB;IAC7D,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;IACjC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,SAAS,CAChC,KAAK,EACL,aAAa,CAAC,aAAa,CAAC,EAC5B,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;IACF,OAAO,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAA,kBAAU,EAAC,YAAY,CAAC,CAAC,CAAC,CAAC;AAClF,CAAC"}

package/lib/login-token.mjs

@@ -0,0 +1,151 @@
+/**
+ * WebRTC login tokens minted locally, with no request to Telnyx.
+ *
+ * The token has the same shape as the one
+ * `POST /v2/telephony_credentials/{id}/token` returns, so it is used the same
+ * way: pass it to the WebRTC SDK as `login_token`. Telnyx verifies it on login.
+ * It is the same computation as `TelephonyCredential#to_jwt` in telnyx-ruby.
+ *
+ * The signing material comes from the credential: `token_material` is in the
+ * response of `POST /v2/telephony_credentials` and of
+ * `GET /v2/telephony_credentials/{id}/token_material`. It is as sensitive as
+ * the SIP password, so keep it on the server; never ship it to a browser.
+ *
+ * @example
+ * const { data: credential } = await client.telephonyCredentials.create({
+ *   connection_id: '123',
+ *   include: 'token_material',   // the API returns the material only when asked
+ * });
+ * const loginToken = await client.telephonyCredentials.toJwt(credential);          // 1 hour
+ * const shortLived = await client.telephonyCredentials.toJwt(credential, { ttl: 600 });
+ *
+ * To mint later with no request at all, store these with the user the credential
+ * belongs to, server side: `id`, `user_id`, `sip_username`, `expires_at` and
+ * `token_material`. The token is built from all of them.
+ *
+ * @example From stored values, without a request at all
+ * import { createLoginToken } from 'telnyx/lib/login-token';
+ * const loginToken = await createLoginToken({
+ *   id: '...', user_id: '...', sip_username: 'gencred...', expires_at: '2027-01-01T00:00:00Z',
+ *   token_material: { kid: 'v1', tel_token: '...', signing_secret: '...' },
+ * });
+ */
+import { TelnyxError } from "../core/error.mjs";
+import { fromBase64, toBase64 } from "../internal/utils/base64.mjs";
+import { decodeUTF8, encodeUTF8 } from "../internal/utils/bytes.mjs";
+/** Token lifetime when `ttl` is not given: one hour. */
+export const LOGIN_TOKEN_DEFAULT_TTL = 3600;
+/** Longest lifetime a login token can have: one day, the same as API-minted tokens. */
+export const LOGIN_TOKEN_MAX_TTL = 86400;
+/** `cty` header of a locally minted token; voice-sdk-proxy selects the verification path by it. */
+export const LOGIN_TOKEN_CONTENT_TYPE = 'telnyx-webrtc;v=1';
+export class TelnyxLoginTokenError extends TelnyxError {
+    constructor(message) {
+        super(message);
+        this.name = 'TelnyxLoginTokenError';
+    }
+}
+/**
+ * Mints a login token for `credential`, valid from `now` for `ttl` seconds.
+ * Pure computation: HMAC-SHA256 over the token with `token_material.signing_secret`.
+ */
+export async function createLoginToken(credential, options = {}) {
+    const credentialId = required(credential.id, 'id');
+    const userId = required(credential.user_id, 'user_id');
+    const identity = required(credential.sip_username, 'sip_username');
+    const material = normalizeMaterial(options.tokenMaterial ?? credential.token_material);
+    const ttl = clampTtl(options.ttl);
+    const now = options.now === undefined ? Date.now() : Number(options.now);
+    const iat = Math.floor(now / 1000);
+    // Same field order as the Ruby SDK, so the two produce the same bytes.
+    const header = { alg: 'HS256', typ: 'JWT', cty: LOGIN_TOKEN_CONTENT_TYPE, kid: material.kid };
+    const payload = {
+        sub: credentialId,
+        user_id: userId,
+        identity,
+        cred_exp: credential.expires_at ?? null,
+        tel_token: material.tel_token,
+        iat,
+        nbf: iat,
+        exp: iat + ttl,
+        jti: `${credentialId}-${iat}`,
+    };
+    const signingInput = `${base64url(JSON.stringify(header))}.${base64url(JSON.stringify(payload))}`;
+    return `${signingInput}.${base64url(await sign(signingInput, material.signing_secret))}`;
+}
+/**
+ * Checks a token minted by `createLoginToken` against `signingSecret` and
+ * returns its claims. For tests and debugging: Telnyx does the real
+ * verification on login.
+ */
+export async function decodeLoginToken(jwt, signingSecret) {
+    const [head, body, sig, ...rest] = String(jwt).split('.');
+    if (!head || !body || sig === undefined || rest.length) {
+        throw new TelnyxLoginTokenError('not a JWT');
+    }
+    const expected = await sign(`${head}.${body}`, signingSecret);
+    const given = fromBase64url(sig);
+    if (!bytesEqual(given, expected)) {
+        throw new TelnyxLoginTokenError('Signature is invalid and does not match the payload');
+    }
+    return JSON.parse(decodeUTF8(fromBase64url(body)));
+}
+function required(value, name) {
+    if (value === undefined || value === null || String(value) === '') {
+        throw new TelnyxLoginTokenError(`${name} is required to mint a token`);
+    }
+    return String(value);
+}
+function normalizeMaterial(material) {
+    if (!material || typeof material !== 'object') {
+        throw new TelnyxLoginTokenError('token_material is required to mint a token');
+    }
+    const out = {};
+    for (const field of ['kid', 'tel_token', 'signing_secret']) {
+        const value = material[field];
+        if (value === undefined || value === null || String(value) === '') {
+            throw new TelnyxLoginTokenError(`token_material.${field} is missing`);
+        }
+        out[field] = String(value);
+    }
+    return out;
+}
+function clampTtl(ttl) {
+    const n = ttl === undefined ? LOGIN_TOKEN_DEFAULT_TTL : Math.trunc(Number(ttl));
+    if (!Number.isFinite(n))
+        return LOGIN_TOKEN_DEFAULT_TTL;
+    return Math.min(LOGIN_TOKEN_MAX_TTL, Math.max(1, n));
+}
+function base64url(data) {
+    // Base64 pads with at most two '=': a bounded match keeps this linear on any input.
+    return toBase64(data)
+        .replace(/\+/g, '-')
+        .replace(/\//g, '_')
+        .replace(/={1,2}$/, '');
+}
+function fromBase64url(str) {
+    const b64 = str.replace(/-/g, '+').replace(/_/g, '/');
+    return fromBase64(b64 + '='.repeat((4 - (b64.length % 4)) % 4));
+}
+function bytesEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < a.length; i++)
+        diff |= a[i] ^ b[i];
+    return diff === 0;
+}
+async function getSubtle() {
+    if (typeof globalThis.crypto !== 'undefined' && globalThis.crypto.subtle) {
+        return globalThis.crypto.subtle;
+    }
+    // Node.js < 19 may need webcrypto from crypto module
+    const nodeCrypto = await import('crypto');
+    return nodeCrypto.webcrypto.subtle;
+}
+async function sign(signingInput, signingSecret) {
+    const subtle = await getSubtle();
+    const key = await subtle.importKey('raw', fromBase64url(signingSecret), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+    return new Uint8Array(await subtle.sign('HMAC', key, encodeUTF8(signingInput)));
+}
+//# sourceMappingURL=login-token.mjs.map

package/lib/login-token.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-token.mjs","sourceRoot":"","sources":["../src/lib/login-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,WAAW,EAAE,0BAAsB;AAC5C,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,qCAAiC;AAChE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,oCAAgC;AAEjE,wDAAwD;AACxD,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,CAAC;AAC5C,uFAAuF;AACvF,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,CAAC;AACzC,mGAAmG;AACnG,MAAM,CAAC,MAAM,wBAAwB,GAAG,mBAAmB,CAAC;AAsC5D,MAAM,OAAO,qBAAsB,SAAQ,WAAW;IACpD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,UAAgC,EAChC,UAA6B,EAAE;IAE/B,MAAM,YAAY,GAAG,QAAQ,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,QAAQ,CAAC,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,QAAQ,CAAC,UAAU,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;IACnE,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,aAAa,IAAI,UAAU,CAAC,cAAc,CAAC,CAAC;IACvF,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACzE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;IAEnC,uEAAuE;IACvE,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,wBAAwB,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC;IAC9F,MAAM,OAAO,GAAG;QACd,GAAG,EAAE,YAAY;QACjB,OAAO,EAAE,MAAM;QACf,QAAQ;QACR,QAAQ,EAAE,UAAU,CAAC,UAAU,IAAI,IAAI;QACvC,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,GAAG;QACH,GAAG,EAAE,GAAG;QACR,GAAG,EAAE,GAAG,GAAG,GAAG;QACd,GAAG,EAAE,GAAG,YAAY,IAAI,GAAG,EAAE;KAC9B,CAAC;IAEF,MAAM,YAAY,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;IAClG,OAAO,GAAG,YAAY,IAAI,SAAS,CAAC,MAAM,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC;AAC3F,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAW,EAAE,aAAqB;IACvE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1D,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,IAAI,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QACvD,MAAM,IAAI,qBAAqB,CAAC,WAAW,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,EAAE,aAAa,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,qBAAqB,CAAC,qDAAqD,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAA4B,CAAC;AAChF,CAAC;AAED,SAAS,QAAQ,CAAC,KAAgC,EAAE,IAAY;IAC9D,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAClE,MAAM,IAAI,qBAAqB,CAAC,GAAG,IAAI,8BAA8B,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,iBAAiB,CAAC,QAA0C;IACnE,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9C,MAAM,IAAI,qBAAqB,CAAC,4CAA4C,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,GAAG,GAAG,EAAyC,CAAC;IACtD,KAAK,MAAM,KAAK,IAAI,CAAC,KAAK,EAAE,WAAW,EAAE,gBAAgB,CAAU,EAAE,CAAC;QACpE,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;YAClE,MAAM,IAAI,qBAAqB,CAAC,kBAAkB,KAAK,aAAa,CAAC,CAAC;QACxE,CAAC;QACD,GAAG,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,QAAQ,CAAC,GAAuB;IACvC,MAAM,CAAC,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAChF,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,uBAAuB,CAAC;IACxD,OAAO,IAAI,CAAC,GAAG,CAAC,mBAAmB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,SAAS,CAAC,IAAyB;IAC1C,oFAAoF;IACpF,OAAO,QAAQ,CAAC,IAAI,CAAC;SAClB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACtD,OAAO,UAAU,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,UAAU,CAAC,CAAa,EAAE,CAAa;IAC9C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;IACzD,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC;AAcD,KAAK,UAAU,SAAS;IACtB,IAAI,OAAO,UAAU,CAAC,MAAM,KAAK,WAAW,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACzE,OAAO,UAAU,CAAC,MAAM,CAAC,MAAqC,CAAC;IACjE,CAAC;IACD,qDAAqD;IACrD,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC1C,OAAQ,UAAU,CAAC,SAAqD,CAAC,MAAM,CAAC;AAClF,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,YAAoB,EAAE,aAAqB;IAC7D,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;IACjC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,SAAS,CAChC,KAAK,EACL,aAAa,CAAC,aAAa,CAAC,EAC5B,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;IACF,OAAO,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;AAClF,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "telnyx",
-  "version": "7.29.0",
+  "version": "7.30.0-beta.0",
   "description": "The official TypeScript library for the Telnyx API",
   "author": "Telnyx <support@telnyx.com>",
   "types": "./index.d.ts",

package/resources/telephony-credentials.d.mts

@@ -2,6 +2,7 @@ import { APIResource } from "../core/resource.mjs";
 import { APIPromise } from "../core/api-promise.mjs";
 import { DefaultFlatPagination, type DefaultFlatPaginationParams, PagePromise } from "../core/pagination.mjs";
 import { RequestOptions } from "../internal/request-options.mjs";
+import { type LoginTokenOptions, type TokenMaterial } from "../lib/login-token.mjs";
 export declare class TelephonyCredentials extends APIResource {
     /**
      * Returns a paginated list of the on-demand telephony credentials on your account,
@@ -28,7 +29,7 @@ export declare class TelephonyCredentials extends APIResource {
      *   });
      * ```
      */
-    create(body: TelephonyCredentialCreateParams, options?: RequestOptions): APIPromise<TelephonyCredentialCreateResponse>;
+    create(params: TelephonyCredentialCreateParams, options?: RequestOptions): APIPromise<TelephonyCredentialCreateResponse>;
     /**
      * Permanently deletes the specified telephony credential, revoking any access it
      * provided.
@@ -60,6 +61,37 @@ export declare class TelephonyCredentials extends APIResource {
      * ```
      */
     update(id: string, body: TelephonyCredentialUpdateParams, options?: RequestOptions): APIPromise<TelephonyCredentialUpdateResponse>;
+    /**
+     * The material a login token is signed with (`kid`, `tel_token`,
+     * `signing_secret`), for a credential that did not come from `create`. Treat
+     * the result like the SIP password.
+     *
+     * @example
+     * ```ts
+     * const { data: tokenMaterial } =
+     *   await client.telephonyCredentials.retrieveTokenMaterial('id');
+     * ```
+     */
+    retrieveTokenMaterial(id: string, options?: RequestOptions): APIPromise<TelephonyCredentialRetrieveTokenMaterialResponse>;
+    /**
+     * Mints a WebRTC login token for the credential locally: the same use as
+     * `createToken`, with no request to Telnyx per token. Uses the
+     * `token_material` of a credential from `create`, or `tokenMaterial` from the
+     * options, or fetches it once with `retrieveTokenMaterial`.
+     *
+     * `ttl` is the token lifetime in seconds, 1..86400, default one hour.
+     *
+     * @example
+     * ```ts
+     * const { data: credential } = await client.telephonyCredentials.create({
+     *   connection_id: '1234567890',
+     * });
+     * const loginToken = await client.telephonyCredentials.toJwt(credential);
+     * ```
+     */
+    toJwt(credential: TelephonyCredential, options?: LoginTokenOptions & {
+        requestOptions?: RequestOptions | undefined;
+    }): Promise<string>;
     /**
      * Create an Access Token (JWT) for the credential.
      *
@@ -114,6 +146,14 @@ export interface TelephonyCredential {
      * Identifies the user this credential is associated with.
      */
     user_id?: string;
+    /**
+     * What a login token is signed with. Returned by `create`; see `toJwt` and
+     * `retrieveTokenMaterial`.
+     */
+    token_material?: TokenMaterial;
+}
+export interface TelephonyCredentialRetrieveTokenMaterialResponse {
+    data?: TokenMaterial;
 }
 export interface TelephonyCredentialCreateResponse {
     data?: TelephonyCredential;
@@ -164,6 +204,11 @@ export declare namespace TelephonyCredentialListParams {
     }
 }
 export interface TelephonyCredentialCreateParams {
+    /**
+     * Query param: extra fields to return. `token_material` adds what `toJwt` signs
+     * with (as sensitive as `sip_password`; keep it on the server).
+     */
+    include?: 'token_material' | undefined;
     /**
      * Identifies the Credential Connection this credential is associated with.
      */
@@ -202,7 +247,8 @@ export interface TelephonyCredentialCreateTokenParams {
      */
     'Idempotency-Key'?: string;
 }
+export type { LoginTokenOptions, TokenMaterial } from "../lib/login-token.mjs";
 export declare namespace TelephonyCredentials {
-    export { type TelephonyCredential as TelephonyCredential, type TelephonyCredentialCreateResponse as TelephonyCredentialCreateResponse, type TelephonyCredentialRetrieveResponse as TelephonyCredentialRetrieveResponse, type TelephonyCredentialUpdateResponse as TelephonyCredentialUpdateResponse, type TelephonyCredentialDeleteResponse as TelephonyCredentialDeleteResponse, type TelephonyCredentialCreateTokenResponse as TelephonyCredentialCreateTokenResponse, type TelephonyCredentialsDefaultFlatPagination as TelephonyCredentialsDefaultFlatPagination, type TelephonyCredentialListParams as TelephonyCredentialListParams, type TelephonyCredentialCreateParams as TelephonyCredentialCreateParams, type TelephonyCredentialUpdateParams as TelephonyCredentialUpdateParams, type TelephonyCredentialCreateTokenParams as TelephonyCredentialCreateTokenParams, };
+    export { type TelephonyCredential as TelephonyCredential, type TelephonyCredentialCreateResponse as TelephonyCredentialCreateResponse, type TelephonyCredentialRetrieveResponse as TelephonyCredentialRetrieveResponse, type TelephonyCredentialUpdateResponse as TelephonyCredentialUpdateResponse, type TelephonyCredentialDeleteResponse as TelephonyCredentialDeleteResponse, type TelephonyCredentialCreateTokenResponse as TelephonyCredentialCreateTokenResponse, type TelephonyCredentialRetrieveTokenMaterialResponse as TelephonyCredentialRetrieveTokenMaterialResponse, type TokenMaterial as TokenMaterial, type TelephonyCredentialsDefaultFlatPagination as TelephonyCredentialsDefaultFlatPagination, type TelephonyCredentialListParams as TelephonyCredentialListParams, type TelephonyCredentialCreateParams as TelephonyCredentialCreateParams, type TelephonyCredentialUpdateParams as TelephonyCredentialUpdateParams, type TelephonyCredentialCreateTokenParams as TelephonyCredentialCreateTokenParams, };
 }
 //# sourceMappingURL=telephony-credentials.d.mts.map

package/resources/telephony-credentials.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"telephony-credentials.d.mts","sourceRoot":"","sources":["../src/resources/telephony-credentials.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,6BAAyB;AAC/C,OAAO,EAAE,UAAU,EAAE,gCAA4B;AACjD,OAAO,EAAE,qBAAqB,EAAE,KAAK,2BAA2B,EAAE,WAAW,EAAE,+BAA2B;AAE1G,OAAO,EAAE,cAAc,EAAE,wCAAoC;AAG7D,qBAAa,oBAAqB,SAAQ,WAAW;IACnD;;;;;;;;;;;OAWG;IACH,IAAI,CACF,KAAK,GAAE,6BAA6B,GAAG,IAAI,GAAG,SAAc,EAC5D,OAAO,CAAC,EAAE,cAAc,GACvB,WAAW,CAAC,yCAAyC,EAAE,mBAAmB,CAAC;IAO9E;;;;;;;;;;;OAWG;IACH,MAAM,CACJ,IAAI,EAAE,+BAA+B,EACrC,OAAO,CAAC,EAAE,cAAc,GACvB,UAAU,CAAC,iCAAiC,CAAC;IAIhD;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,UAAU,CAAC,iCAAiC,CAAC;IAI3F;;;;;;;;OAQG;IACH,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,UAAU,CAAC,mCAAmC,CAAC;IAI/F;;;;;;;;OAQG;IACH,MAAM,CACJ,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,+BAA+B,EACrC,OAAO,CAAC,EAAE,cAAc,GACvB,UAAU,CAAC,iCAAiC,CAAC;IAIhD;;;;;;;;OAQG;IACH,WAAW,CACT,EAAE,EAAE,MAAM,EACV,MAAM,GAAE,oCAAoC,GAAG,IAAI,GAAG,SAAc,EACpE,OAAO,CAAC,EAAE,cAAc,GACvB,UAAU,CAAC,MAAM,CAAC;CAatB;AAED,MAAM,MAAM,yCAAyC,GAAG,qBAAqB,CAAC,mBAAmB,CAAC,CAAC;AAEnG,MAAM,WAAW,mBAAmB;IAClC;;OAEG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;IAEZ;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;OAEG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,iCAAiC;IAChD,IAAI,CAAC,EAAE,mBAAmB,CAAC;CAC5B;AAED,MAAM,WAAW,mCAAmC;IAClD,IAAI,CAAC,EAAE,mBAAmB,CAAC;CAC5B;AAED,MAAM,WAAW,iCAAiC;IAChD,IAAI,CAAC,EAAE,mBAAmB,CAAC;CAC5B;AAED,MAAM,WAAW,iCAAiC;IAChD,IAAI,CAAC,EAAE,mBAAmB,CAAC;CAC5B;AAED,MAAM,MAAM,sCAAsC,GAAG,MAAM,CAAC;AAE5D,MAAM,WAAW,6BAA8B,SAAQ,2BAA2B;IAChF;;;OAGG;IACH,MAAM,CAAC,EAAE,6BAA6B,CAAC,MAAM,CAAC;CAC/C;AAED,yBAAiB,6BAA6B,CAAC;IAC7C;;;OAGG;IACH,UAAiB,MAAM;QACrB;;WAEG;QACH,IAAI,CAAC,EAAE,MAAM,CAAC;QAEd;;WAEG;QACH,WAAW,CAAC,EAAE,MAAM,CAAC;QAErB;;WAEG;QACH,YAAY,CAAC,EAAE,MAAM,CAAC;QAEtB;;WAEG;QACH,MAAM,CAAC,EAAE,MAAM,CAAC;QAEhB;;WAEG;QACH,GAAG,CAAC,EAAE,MAAM,CAAC;KACd;CACF;AAED,MAAM,WAAW,+BAA+B;IAC9C;;OAEG;IACH,aAAa,EAAE,MAAM,CAAC;IAEtB;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd;;OAEG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,+BAA+B;IAC9C;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd;;OAEG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,oCAAoC;IACnD;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,CAAC,OAAO,WAAW,oBAAoB,CAAC;IAC5C,OAAO,EACL,KAAK,mBAAmB,IAAI,mBAAmB,EAC/C,KAAK,iCAAiC,IAAI,iCAAiC,EAC3E,KAAK,mCAAmC,IAAI,mCAAmC,EAC/E,KAAK,iCAAiC,IAAI,iCAAiC,EAC3E,KAAK,iCAAiC,IAAI,iCAAiC,EAC3E,KAAK,sCAAsC,IAAI,sCAAsC,EACrF,KAAK,yCAAyC,IAAI,yCAAyC,EAC3F,KAAK,6BAA6B,IAAI,6BAA6B,EACnE,KAAK,+BAA+B,IAAI,+BAA+B,EACvE,KAAK,+BAA+B,IAAI,+BAA+B,EACvE,KAAK,oCAAoC,IAAI,oCAAoC,GAClF,CAAC;CACH"}
+{"version":3,"file":"telephony-credentials.d.mts","sourceRoot":"","sources":["../src/resources/telephony-credentials.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,6BAAyB;AAC/C,OAAO,EAAE,UAAU,EAAE,gCAA4B;AACjD,OAAO,EAAE,qBAAqB,EAAE,KAAK,2BAA2B,EAAE,WAAW,EAAE,+BAA2B;AAE1G,OAAO,EAAE,cAAc,EAAE,wCAAoC;AAE7D,OAAO,EAAoB,KAAK,iBAAiB,EAAE,KAAK,aAAa,EAAE,+BAA2B;AAElG,qBAAa,oBAAqB,SAAQ,WAAW;IACnD;;;;;;;;;;;OAWG;IACH,IAAI,CACF,KAAK,GAAE,6BAA6B,GAAG,IAAI,GAAG,SAAc,EAC5D,OAAO,CAAC,EAAE,cAAc,GACvB,WAAW,CAAC,yCAAyC,EAAE,mBAAmB,CAAC;IAO9E;;;;;;;;;;;OAWG;IACH,MAAM,CACJ,MAAM,EAAE,+BAA+B,EACvC,OAAO,CAAC,EAAE,cAAc,GACvB,UAAU,CAAC,iCAAiC,CAAC;IAUhD;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,UAAU,CAAC,iCAAiC,CAAC;IAI3F;;;;;;;;OAQG;IACH,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,UAAU,CAAC,mCAAmC,CAAC;IAI/F;;;;;;;;OAQG;IACH,MAAM,CACJ,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,+BAA+B,EACrC,OAAO,CAAC,EAAE,cAAc,GACvB,UAAU,CAAC,iCAAiC,CAAC;IAIhD;;;;;;;;;;OAUG;IACH,qBAAqB,CACnB,EAAE,EAAE,MAAM,EACV,OAAO,CAAC,EAAE,cAAc,GACvB,UAAU,CAAC,gDAAgD,CAAC;IAI/D;;;;;;;;;;;;;;;OAeG;IACG,KAAK,CACT,UAAU,EAAE,mBAAmB,EAC/B,OAAO,CAAC,EAAE,iBAAiB,GAAG;QAAE,cAAc,CAAC,EAAE,cAAc,GAAG,SAAS,CAAA;KAAE,GAC5E,OAAO,CAAC,MAAM,CAAC;IASlB;;;;;;;;OAQG;IACH,WAAW,CACT,EAAE,EAAE,MAAM,EACV,MAAM,GAAE,oCAAoC,GAAG,IAAI,GAAG,SAAc,EACpE,OAAO,CAAC,EAAE,cAAc,GACvB,UAAU,CAAC,MAAM,CAAC;CAatB;AAED,MAAM,MAAM,yCAAyC,GAAG,qBAAqB,CAAC,mBAAmB,CAAC,CAAC;AAEnG,MAAM,WAAW,mBAAmB;IAClC;;OAEG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;IAEZ;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;OAEG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB;;;OAGG;IACH,cAAc,CAAC,EAAE,aAAa,CAAC;CAChC;AAED,MAAM,WAAW,gDAAgD;IAC/D,IAAI,CAAC,EAAE,aAAa,CAAC;CACtB;AAED,MAAM,WAAW,iCAAiC;IAChD,IAAI,CAAC,EAAE,mBAAmB,CAAC;CAC5B;AAED,MAAM,WAAW,mCAAmC;IAClD,IAAI,CAAC,EAAE,mBAAmB,CAAC;CAC5B;AAED,MAAM,WAAW,iCAAiC;IAChD,IAAI,CAAC,EAAE,mBAAmB,CAAC;CAC5B;AAED,MAAM,WAAW,iCAAiC;IAChD,IAAI,CAAC,EAAE,mBAAmB,CAAC;CAC5B;AAED,MAAM,MAAM,sCAAsC,GAAG,MAAM,CAAC;AAE5D,MAAM,WAAW,6BAA8B,SAAQ,2BAA2B;IAChF;;;OAGG;IACH,MAAM,CAAC,EAAE,6BAA6B,CAAC,MAAM,CAAC;CAC/C;AAED,yBAAiB,6BAA6B,CAAC;IAC7C;;;OAGG;IACH,UAAiB,MAAM;QACrB;;WAEG;QACH,IAAI,CAAC,EAAE,MAAM,CAAC;QAEd;;WAEG;QACH,WAAW,CAAC,EAAE,MAAM,CAAC;QAErB;;WAEG;QACH,YAAY,CAAC,EAAE,MAAM,CAAC;QAEtB;;WAEG;QACH,MAAM,CAAC,EAAE,MAAM,CAAC;QAEhB;;WAEG;QACH,GAAG,CAAC,EAAE,MAAM,CAAC;KACd;CACF;AAED,MAAM,WAAW,+BAA+B;IAC9C;;;OAGG;IACH,OAAO,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAEvC;;OAEG;IACH,aAAa,EAAE,MAAM,CAAC;IAEtB;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd;;OAEG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,+BAA+B;IAC9C;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd;;OAEG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,oCAAoC;IACnD;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,YAAY,EAAE,iBAAiB,EAAE,aAAa,EAAE,+BAA2B;AAE3E,MAAM,CAAC,OAAO,WAAW,oBAAoB,CAAC;IAC5C,OAAO,EACL,KAAK,mBAAmB,IAAI,mBAAmB,EAC/C,KAAK,iCAAiC,IAAI,iCAAiC,EAC3E,KAAK,mCAAmC,IAAI,mCAAmC,EAC/E,KAAK,iCAAiC,IAAI,iCAAiC,EAC3E,KAAK,iCAAiC,IAAI,iCAAiC,EAC3E,KAAK,sCAAsC,IAAI,sCAAsC,EACrF,KAAK,gDAAgD,IAAI,gDAAgD,EACzG,KAAK,aAAa,IAAI,aAAa,EACnC,KAAK,yCAAyC,IAAI,yCAAyC,EAC3F,KAAK,6BAA6B,IAAI,6BAA6B,EACnE,KAAK,+BAA+B,IAAI,+BAA+B,EACvE,KAAK,+BAA+B,IAAI,+BAA+B,EACvE,KAAK,oCAAoC,IAAI,oCAAoC,GAClF,CAAC;CACH"}