@absolutejs/voice 0.0.22-beta.271 → 0.0.22-beta.273

package/dist/index.d.ts

@@ -159,13 +159,15 @@ export type { VoiceS3ReviewStoreClient, VoiceS3ReviewStoreFile, VoiceS3ReviewSto
 export type { VoiceSQLiteRuntimeStorage, VoiceSQLiteStoreOptions } from './sqliteStore';
 export type { StoredVoiceIntegrationEvent, StoredVoiceExternalObjectMap, StoredVoiceOpsTask, VoiceExternalObjectMap, VoiceExternalObjectMapStore, VoiceOpsTaskAgeBucket, VoiceOpsTaskAnalyticsOptions, VoiceOpsTaskAnalyticsSummary, VoiceOpsTaskAssignmentRule, VoiceOpsTaskAssignmentRuleCondition, VoiceOpsTaskAssignmentRules, VoiceOpsTaskAssigneeAnalytics, VoiceOpsDispositionTaskPolicies, VoiceOpsSLABreachPolicy, VoiceIntegrationDeliveryStatus, VoiceIntegrationEvent, VoiceIntegrationEventStore, VoiceIntegrationSinkDelivery, VoiceIntegrationEventType, VoiceIntegrationWebhookConfig, VoiceOpsTask, VoiceOpsTaskHistoryEntry, VoiceOpsTaskKind, VoiceOpsTaskPolicy, VoiceOpsTaskPriority, VoiceOpsTaskStatus, VoiceOpsTaskStore, VoiceOpsTaskSummary, VoiceOpsTaskWorkerAnalytics } from './ops';
 export { createTwilioMediaStreamBridge, createTwilioVoiceRoutes, createTwilioVoiceResponse, decodeTwilioMulawBase64, encodeTwilioMulawBase64, transcodePCMToTwilioOutboundPayload, transcodeTwilioInboundPayloadToPCM16 } from './telephony/twilio';
+export { createVoiceTelephonyWebhookSecurityPreset } from './telephony/security';
 export { evaluateVoiceTelephonyContract } from './telephony/contract';
-export { createTelnyxMediaStreamBridge, createTelnyxVoiceResponse, createTelnyxVoiceRoutes, verifyVoiceTelnyxWebhookSignature } from './telephony/telnyx';
+export { createMemoryVoiceTelnyxWebhookEventStore, createTelnyxMediaStreamBridge, createTelnyxVoiceResponse, createTelnyxVoiceRoutes, createVoicePostgresTelnyxWebhookEventStore, createVoiceRedisTelnyxWebhookEventStore, createVoiceSQLiteTelnyxWebhookEventStore, createVoiceTelnyxWebhookVerifier, verifyVoiceTelnyxWebhookSignature } from './telephony/telnyx';
 export { createMemoryVoicePlivoWebhookNonceStore, createPlivoMediaStreamBridge, createPlivoVoiceResponse, createPlivoVoiceRoutes, createVoicePostgresPlivoWebhookNonceStore, createVoicePlivoWebhookVerifier, createVoiceRedisPlivoWebhookNonceStore, createVoiceSQLitePlivoWebhookNonceStore, signVoicePlivoWebhook, verifyVoicePlivoWebhookSignature } from './telephony/plivo';
 export { createVoiceTelephonyCarrierMatrix, createVoiceTelephonyCarrierMatrixRoutes, renderVoiceTelephonyCarrierMatrixHTML } from './telephony/matrix';
 export type { TwilioInboundMessage, TwilioMediaStreamBridge, TwilioMediaStreamBridgeOptions, TwilioMediaStreamSocket, TwilioOutboundClearMessage, TwilioOutboundMarkMessage, TwilioOutboundMediaMessage, TwilioOutboundMessage, TwilioVoiceRouteParameters, TwilioVoiceResponseOptions, TwilioVoiceSmokeCheck, TwilioVoiceSmokeOptions, TwilioVoiceSmokeReport, TwilioVoiceSetupOptions, TwilioVoiceSetupStatus, TwilioVoiceRoutesOptions } from './telephony/twilio';
+export type { VoiceTelephonyWebhookSecurityOptions, VoiceTelephonyWebhookSecurityPreset, VoiceTelephonyWebhookSecurityStorePreset } from './telephony/security';
 export type { VoiceTelephonyContractIssue, VoiceTelephonyContractOptions, VoiceTelephonyContractReport, VoiceTelephonyContractRequirement, VoiceTelephonyProvider, VoiceTelephonySetupStatus, VoiceTelephonySmokeCheck, VoiceTelephonySmokeReport } from './telephony/contract';
-export type { TelnyxInboundMessage, TelnyxMediaPayload, TelnyxMediaStreamBridge, TelnyxMediaStreamBridgeOptions, TelnyxMediaStreamSocket, TelnyxOutboundClearMessage, TelnyxOutboundMarkMessage, TelnyxOutboundMediaMessage, TelnyxOutboundMessage, TelnyxVoiceResponseOptions, TelnyxVoiceRoutesOptions, TelnyxVoiceSetupOptions, TelnyxVoiceSetupStatus, TelnyxVoiceSmokeCheck, TelnyxVoiceSmokeOptions, TelnyxVoiceSmokeReport } from './telephony/telnyx';
+export type { TelnyxInboundMessage, TelnyxMediaPayload, TelnyxMediaStreamBridge, TelnyxMediaStreamBridgeOptions, TelnyxMediaStreamSocket, TelnyxOutboundClearMessage, TelnyxOutboundMarkMessage, TelnyxOutboundMediaMessage, TelnyxOutboundMessage, TelnyxVoiceResponseOptions, TelnyxVoiceRoutesOptions, TelnyxVoiceSetupOptions, TelnyxVoiceSetupStatus, TelnyxVoiceSmokeCheck, TelnyxVoiceSmokeOptions, TelnyxVoiceSmokeReport, VoicePostgresTelnyxWebhookEventStoreOptions, VoiceRedisTelnyxWebhookEventClient, VoiceRedisTelnyxWebhookEventStoreOptions, VoiceSQLiteTelnyxWebhookEventStoreOptions, VoiceTelnyxWebhookEventStore, VoiceTelnyxWebhookEventStoreOptions, VoiceTelnyxWebhookVerifierOptions } from './telephony/telnyx';
 export type { PlivoInboundMessage, PlivoMediaStreamBridge, PlivoMediaStreamBridgeOptions, PlivoMediaStreamSocket, PlivoOutboundCheckpointMessage, PlivoOutboundClearAudioMessage, PlivoOutboundMessage, PlivoOutboundPlayAudioMessage, PlivoVoiceResponseOptions, PlivoVoiceRoutesOptions, PlivoVoiceSetupOptions, PlivoVoiceSetupStatus, PlivoVoiceSmokeCheck, PlivoVoiceSmokeOptions, PlivoVoiceSmokeReport, VoicePostgresPlivoWebhookNonceStoreOptions, VoicePlivoWebhookNonceStore, VoicePlivoWebhookNonceStoreOptions, VoicePlivoWebhookVerifierOptions, VoiceRedisPlivoWebhookNonceClient, VoiceRedisPlivoWebhookNonceStoreOptions, VoiceSQLitePlivoWebhookNonceStoreOptions } from './telephony/plivo';
 export type { VoiceTelephonyCarrierMatrix, VoiceTelephonyCarrierMatrixEntry, VoiceTelephonyCarrierMatrixInput, VoiceTelephonyCarrierMatrixOptions, VoiceTelephonyCarrierMatrixRoutesOptions, VoiceTelephonyCarrierMatrixStatus } from './telephony/matrix';
 export { shapeTelephonyAssistantText } from './telephony/response';

package/dist/index.js

@@ -19549,6 +19549,7 @@ var createPlivoVoiceRoutes = (options = {}) => {
 
 // src/telephony/telnyx.ts
 import { Buffer as Buffer6 } from "buffer";
+import { Database as Database2 } from "bun:sqlite";
 import { Elysia as Elysia31 } from "elysia";
 var escapeXml4 = (value) => value.replaceAll("&", "&amp;").replaceAll('"', "&quot;").replaceAll("'", "&apos;").replaceAll("<", "&lt;").replaceAll(">", "&gt;");
 var escapeHtml30 = (value) => value.replaceAll("&", "&amp;").replaceAll('"', "&quot;").replaceAll("'", "&#39;").replaceAll("<", "&lt;").replaceAll(">", "&gt;");
@@ -19721,6 +19722,198 @@ var verifyVoiceTelnyxWebhookSignature = async (input) => {
     return { ok: false, reason: "invalid-signature" };
   }
 };
+var createMemoryVoiceTelnyxWebhookEventStore = () => {
+  const eventIds = new Set;
+  return {
+    claim: (eventId) => {
+      if (eventIds.has(eventId)) {
+        return false;
+      }
+      eventIds.add(eventId);
+      return true;
+    },
+    has: (eventId) => eventIds.has(eventId),
+    set: (eventId) => {
+      eventIds.add(eventId);
+    }
+  };
+};
+var normalizeTelnyxStoreIdentifierSegment = (value) => value.trim().replace(/[^a-zA-Z0-9_]+/g, "_").replace(/^_+|_+$/g, "") || "voice";
+var quoteTelnyxStoreIdentifier = (value) => `"${value.replace(/"/g, '""')}"`;
+var resolveTelnyxEventTableName = (input) => {
+  if (input.tableName) {
+    return normalizeTelnyxStoreIdentifierSegment(input.tableName);
+  }
+  return `${normalizeTelnyxStoreIdentifierSegment(input.tablePrefix ?? "voice")}_${normalizeTelnyxStoreIdentifierSegment(input.fallback)}`;
+};
+var getTelnyxEventExpiresAt = (ttlSeconds) => typeof ttlSeconds === "number" && ttlSeconds > 0 ? Date.now() + Math.ceil(ttlSeconds * 1000) : null;
+var createVoiceSQLiteTelnyxWebhookEventStore = (options) => {
+  const database = options.database ?? new Database2(options.path ?? ":memory:", {
+    create: true
+  });
+  const tableName = resolveTelnyxEventTableName({
+    fallback: "telnyx_webhook_events",
+    tableName: options.tableName,
+    tablePrefix: options.tablePrefix
+  });
+  database.exec(`CREATE TABLE IF NOT EXISTS "${tableName}" (
+			event_id TEXT PRIMARY KEY,
+			created_at INTEGER NOT NULL,
+			expires_at INTEGER
+		)`);
+  const pruneExpired = database.query(`DELETE FROM "${tableName}" WHERE expires_at IS NOT NULL AND expires_at <= ?1`);
+  const select = database.query(`SELECT event_id FROM "${tableName}" WHERE event_id = ?1 AND (expires_at IS NULL OR expires_at > ?2) LIMIT 1`);
+  const insert = database.query(`INSERT OR IGNORE INTO "${tableName}" (event_id, created_at, expires_at) VALUES (?1, ?2, ?3)`);
+  const upsert = database.query(`INSERT INTO "${tableName}" (event_id, created_at, expires_at) VALUES (?1, ?2, ?3)
+		 ON CONFLICT(event_id) DO UPDATE SET expires_at = excluded.expires_at`);
+  return {
+    claim: (eventId) => {
+      const now = Date.now();
+      pruneExpired.run(now);
+      const result = insert.run(eventId, now, getTelnyxEventExpiresAt(options.ttlSeconds));
+      return result.changes > 0;
+    },
+    has: (eventId) => Boolean(select.get(eventId, Date.now())),
+    set: (eventId) => {
+      upsert.run(eventId, Date.now(), getTelnyxEventExpiresAt(options.ttlSeconds));
+    }
+  };
+};
+var createVoiceTelnyxPostgresClient = async (options) => {
+  if (options.sql) {
+    return options.sql;
+  }
+  if (!options.connectionString) {
+    throw new Error("createVoicePostgresTelnyxWebhookEventStore requires either options.sql or options.connectionString.");
+  }
+  const sql = new Bun.SQL(options.connectionString);
+  return {
+    unsafe: sql.unsafe.bind(sql)
+  };
+};
+var resolveTelnyxEventQualifiedTableName = (options) => {
+  const schema = normalizeTelnyxStoreIdentifierSegment(options.schemaName ?? "public");
+  const table = resolveTelnyxEventTableName({
+    fallback: "telnyx_webhook_events",
+    tableName: options.tableName,
+    tablePrefix: options.tablePrefix
+  });
+  return `${quoteTelnyxStoreIdentifier(schema)}.${quoteTelnyxStoreIdentifier(table)}`;
+};
+var createVoicePostgresTelnyxWebhookEventStore = (options = {}) => {
+  const qualifiedTableName = resolveTelnyxEventQualifiedTableName(options);
+  const schemaMatch = qualifiedTableName.match(/^"([^"]+)"\./);
+  const client = createVoiceTelnyxPostgresClient(options);
+  const initialized = (async () => {
+    const sql = await client;
+    if (schemaMatch?.[1]) {
+      await sql.unsafe(`CREATE SCHEMA IF NOT EXISTS ${quoteTelnyxStoreIdentifier(schemaMatch[1])}`);
+    }
+    await sql.unsafe(`CREATE TABLE IF NOT EXISTS ${qualifiedTableName} (
+				event_id TEXT PRIMARY KEY,
+				created_at BIGINT NOT NULL,
+				expires_at BIGINT
+			)`);
+  })();
+  const pruneExpired = async () => {
+    await initialized;
+    const sql = await client;
+    await sql.unsafe(`DELETE FROM ${qualifiedTableName} WHERE expires_at IS NOT NULL AND expires_at <= $1`, [Date.now()]);
+  };
+  return {
+    claim: async (eventId) => {
+      await pruneExpired();
+      const sql = await client;
+      const rows = await sql.unsafe(`INSERT INTO ${qualifiedTableName} (event_id, created_at, expires_at)
+				 VALUES ($1, $2, $3)
+				 ON CONFLICT (event_id) DO NOTHING
+				 RETURNING event_id`, [eventId, Date.now(), getTelnyxEventExpiresAt(options.ttlSeconds)]);
+      return rows.length > 0;
+    },
+    has: async (eventId) => {
+      await initialized;
+      const sql = await client;
+      const rows = await sql.unsafe(`SELECT event_id FROM ${qualifiedTableName}
+				 WHERE event_id = $1 AND (expires_at IS NULL OR expires_at > $2)
+				 LIMIT 1`, [eventId, Date.now()]);
+      return rows.length > 0;
+    },
+    set: async (eventId) => {
+      await initialized;
+      const sql = await client;
+      await sql.unsafe(`INSERT INTO ${qualifiedTableName} (event_id, created_at, expires_at)
+				 VALUES ($1, $2, $3)
+				 ON CONFLICT (event_id) DO UPDATE SET expires_at = EXCLUDED.expires_at`, [eventId, Date.now(), getTelnyxEventExpiresAt(options.ttlSeconds)]);
+    }
+  };
+};
+var getTelnyxRedisEventKey = (keyPrefix, eventId) => `${keyPrefix}:${eventId}`;
+var createVoiceRedisTelnyxWebhookEventStore = (options = {}) => {
+  const client = options.client ?? new Bun.RedisClient(options.url);
+  const keyPrefix = options.keyPrefix?.trim() || "voice:telnyx-webhook-event";
+  const ttlSeconds = options.ttlSeconds;
+  const setEvent = async (eventId, nx) => {
+    const key = getTelnyxRedisEventKey(keyPrefix, eventId);
+    if (typeof ttlSeconds === "number" && ttlSeconds > 0) {
+      return client.set(key, "1", "EX", String(Math.ceil(ttlSeconds)), ...nx ? ["NX"] : []);
+    }
+    return client.set(key, "1", ...nx ? ["NX"] : []);
+  };
+  return {
+    claim: async (eventId) => await setEvent(eventId, true) === "OK",
+    has: async (eventId) => Boolean(await client.exists(getTelnyxRedisEventKey(keyPrefix, eventId))),
+    set: async (eventId) => {
+      await setEvent(eventId, false);
+    }
+  };
+};
+var readTelnyxWebhookEventId = (rawBody) => {
+  try {
+    const body = JSON.parse(rawBody);
+    if (!body || typeof body !== "object" || Array.isArray(body)) {
+      return;
+    }
+    const record = body;
+    const data = record.data;
+    if (data && typeof data === "object" && !Array.isArray(data)) {
+      const eventId2 = data.id;
+      if (typeof eventId2 === "string" && eventId2.trim()) {
+        return eventId2;
+      }
+    }
+    const eventId = record.id ?? record.event_id;
+    return typeof eventId === "string" && eventId.trim() ? eventId : undefined;
+  } catch {
+    return;
+  }
+};
+var createVoiceTelnyxWebhookVerifier = (options) => async (input) => {
+  const verification = await verifyVoiceTelnyxWebhookSignature({
+    body: input.rawBody,
+    headers: input.headers,
+    publicKey: options.publicKey,
+    toleranceSeconds: options.toleranceSeconds
+  });
+  if (!verification.ok) {
+    return verification;
+  }
+  const eventStore = options.eventStore;
+  if (!eventStore) {
+    return verification;
+  }
+  const eventId = readTelnyxWebhookEventId(input.rawBody);
+  if (!eventId) {
+    return { ok: false, reason: "invalid-signature" };
+  }
+  if (eventStore.claim) {
+    return await eventStore.claim(eventId) ? verification : { ok: false, reason: "invalid-signature" };
+  }
+  if (await eventStore.has(eventId)) {
+    return { ok: false, reason: "invalid-signature" };
+  }
+  await eventStore.set(eventId);
+  return verification;
+};
 var buildTelnyxVoiceSetupStatus = async (options, input) => {
   const origin = resolveRequestOrigin3(input.request);
   const stream = await resolveTelnyxStreamUrl(options, input);
@@ -19854,11 +20047,10 @@ var createTelnyxVoiceRoutes = (options = {}) => {
   const smokePath = options.smoke?.path === false ? false : options.smoke?.path ?? "/api/voice/telnyx/smoke";
   const bridges = new WeakMap;
   const webhookPolicy = options.webhook?.policy ?? options.outcomePolicy ?? createVoiceTelephonyOutcomePolicy();
-  const verify = options.webhook?.verify ?? (options.webhook?.publicKey ? (input) => verifyVoiceTelnyxWebhookSignature({
-    body: input.rawBody,
-    headers: input.headers,
-    publicKey: options.webhook?.publicKey,
-    toleranceSeconds: options.webhook?.toleranceSeconds
+  const verify = options.webhook?.verify ?? (options.webhook?.publicKey ? createVoiceTelnyxWebhookVerifier({
+    eventStore: options.webhook.eventStore,
+    publicKey: options.webhook.publicKey,
+    toleranceSeconds: options.webhook.toleranceSeconds
   }) : undefined);
   const app = new Elysia31({
     name: options.name ?? "absolutejs-voice-telnyx"
@@ -23990,7 +24182,7 @@ var createVoiceOpsRecoveryRoutes = (options = {}) => {
 
 // src/observabilityExport.ts
 import { Elysia as Elysia41 } from "elysia";
-import { Database as Database2 } from "bun:sqlite";
+import { Database as Database3 } from "bun:sqlite";
 import { createHash } from "crypto";
 import { mkdir as mkdir4, readFile as readFile2, stat, unlink } from "fs/promises";
 import { join as join3 } from "path";
@@ -25220,7 +25412,7 @@ var loadVoiceObservabilityExportReplaySource = async (source) => {
     if (!source.database && !source.path) {
       throw new Error("SQLite observability export replay requires source.database or source.path.");
     }
-    const database = source.database ?? new Database2(source.path, { create: false });
+    const database = source.database ?? new Database3(source.path, { create: false });
     const table2 = quoteObservabilityIdentifier(normalizeObservabilityIdentifier(source.tableName));
     const row2 = database.query(`SELECT manifest_json, artifact_index_json, payload_json FROM ${table2} WHERE run_id = $runId`).get({ $runId: source.runId });
     if (!row2) {
@@ -25297,7 +25489,7 @@ var deliverObservabilityExportToSQLite = async (input) => {
   if (!input.destination.database && !input.destination.path) {
     throw new Error("SQLite observability export delivery requires destination.database or destination.path.");
   }
-  const database = input.destination.database ?? new Database2(input.destination.path, { create: true });
+  const database = input.destination.database ?? new Database3(input.destination.path, { create: true });
   const table = quoteObservabilityIdentifier(normalizeObservabilityIdentifier(input.destination.tableName));
   const record = buildObservabilityExportDatabaseRecord(input);
   database.exec(`CREATE TABLE IF NOT EXISTS ${table} (
@@ -29407,7 +29599,7 @@ var createVoiceTraceDeliveryRoutes = (options) => {
   return routes;
 };
 // src/sqliteStore.ts
-import { Database as Database3 } from "bun:sqlite";
+import { Database as Database4 } from "bun:sqlite";
 var normalizeTableNameSegment = (value) => value.trim().replace(/[^a-zA-Z0-9_]+/g, "_").replace(/^_+|_+$/g, "") || "voice";
 var resolveTableName = (input) => {
   if (input.options.tableName) {
@@ -29418,7 +29610,7 @@ var resolveTableName = (input) => {
   return `${prefix}_${fallback}`;
 };
 var openVoiceSQLiteDatabase = (path) => {
-  const database = new Database3(path, {
+  const database = new Database4(path, {
     create: true
   });
   database.exec("PRAGMA journal_mode = WAL;");
@@ -31472,6 +31664,139 @@ var createVoiceSTTRoutingCorrectionHandler = (mode = "generic") => {
   }
   return createPhraseHintCorrectionHandler();
 };
+// src/telephony/security.ts
+var resolveVerificationUrl2 = (option, input) => typeof option === "function" ? option(input) : option ?? input.request.url;
+var createStores = (options) => {
+  const ttlSeconds = options.ttlSeconds;
+  const store = options.store ?? { kind: "memory" };
+  if (store.kind === "sqlite") {
+    return {
+      idempotency: options.twilio?.idempotencyStore ?? createVoiceSQLiteTelephonyWebhookIdempotencyStore({
+        path: store.path,
+        tableName: "voice_twilio_webhook_idempotency",
+        tablePrefix: store.tablePrefix
+      }),
+      plivo: options.plivo?.nonceStore ?? createVoiceSQLitePlivoWebhookNonceStore({
+        path: store.path,
+        tableName: "voice_plivo_webhook_nonces",
+        tablePrefix: store.tablePrefix,
+        ttlSeconds
+      }),
+      telnyx: options.telnyx?.eventStore ?? createVoiceSQLiteTelnyxWebhookEventStore({
+        path: store.path,
+        tableName: "voice_telnyx_webhook_events",
+        tablePrefix: store.tablePrefix,
+        ttlSeconds
+      })
+    };
+  }
+  if (store.kind === "postgres") {
+    return {
+      idempotency: options.twilio?.idempotencyStore ?? createVoicePostgresTelephonyWebhookIdempotencyStore({
+        connectionString: store.connectionString,
+        schemaName: store.schemaName,
+        sql: store.sql,
+        tableName: "voice_twilio_webhook_idempotency",
+        tablePrefix: store.tablePrefix
+      }),
+      plivo: options.plivo?.nonceStore ?? createVoicePostgresPlivoWebhookNonceStore({
+        connectionString: store.connectionString,
+        schemaName: store.schemaName,
+        sql: store.sql,
+        tableName: "voice_plivo_webhook_nonces",
+        tablePrefix: store.tablePrefix,
+        ttlSeconds
+      }),
+      telnyx: options.telnyx?.eventStore ?? createVoicePostgresTelnyxWebhookEventStore({
+        connectionString: store.connectionString,
+        schemaName: store.schemaName,
+        sql: store.sql,
+        tableName: "voice_telnyx_webhook_events",
+        tablePrefix: store.tablePrefix,
+        ttlSeconds
+      })
+    };
+  }
+  if (store.kind === "redis") {
+    const keyPrefix = store.keyPrefix?.trim() || "voice:webhook-security";
+    return {
+      idempotency: options.twilio?.idempotencyStore ?? createVoiceRedisTelephonyWebhookIdempotencyStore({
+        client: store.idempotencyClient,
+        keyPrefix: `${keyPrefix}:twilio:idempotency`,
+        ttlSeconds,
+        url: store.url
+      }),
+      plivo: options.plivo?.nonceStore ?? createVoiceRedisPlivoWebhookNonceStore({
+        client: store.plivoClient,
+        keyPrefix: `${keyPrefix}:plivo:nonce`,
+        ttlSeconds,
+        url: store.url
+      }),
+      telnyx: options.telnyx?.eventStore ?? createVoiceRedisTelnyxWebhookEventStore({
+        client: store.telnyxClient,
+        keyPrefix: `${keyPrefix}:telnyx:event`,
+        ttlSeconds,
+        url: store.url
+      })
+    };
+  }
+  return {
+    idempotency: options.twilio?.idempotencyStore ?? createMemoryVoiceTelephonyWebhookIdempotencyStore(),
+    plivo: options.plivo?.nonceStore ?? createMemoryVoicePlivoWebhookNonceStore(),
+    telnyx: options.telnyx?.eventStore ?? createMemoryVoiceTelnyxWebhookEventStore()
+  };
+};
+var createVoiceTelephonyWebhookSecurityPreset = (options = {}) => {
+  const stores = createStores(options);
+  const twilioVerificationUrl = options.twilio?.verificationUrl;
+  const plivoVerify = createVoicePlivoWebhookVerifier({
+    authToken: options.plivo?.authToken,
+    nonceStore: stores.plivo,
+    verificationUrl: options.plivo?.verificationUrl
+  });
+  const telnyxVerify = createVoiceTelnyxWebhookVerifier({
+    eventStore: stores.telnyx,
+    publicKey: options.telnyx?.publicKey,
+    toleranceSeconds: options.telnyx?.toleranceSeconds
+  });
+  const twilioVerify = async (input) => verifyVoiceTwilioWebhookSignature({
+    authToken: options.twilio?.authToken,
+    body: input.body,
+    headers: input.headers,
+    url: resolveVerificationUrl2(twilioVerificationUrl, {
+      query: input.query,
+      request: input.request
+    })
+  });
+  return {
+    plivo: {
+      authToken: options.plivo?.authToken,
+      nonceStore: stores.plivo,
+      verify: plivoVerify
+    },
+    telnyx: {
+      eventStore: stores.telnyx,
+      publicKey: options.telnyx?.publicKey,
+      toleranceSeconds: options.telnyx?.toleranceSeconds,
+      verify: telnyxVerify
+    },
+    twilio: {
+      idempotency: {
+        enabled: true,
+        store: stores.idempotency
+      },
+      requireVerification: true,
+      signingSecret: options.twilio?.authToken,
+      verificationUrl: twilioVerificationUrl,
+      verify: twilioVerify
+    },
+    verify: {
+      plivo: plivoVerify,
+      telnyx: telnyxVerify,
+      twilio: twilioVerify
+    }
+  };
+};
 // src/telephony/response.ts
 var normalizeWhitespace = (value) => value.replace(/\s+/g, " ").trim();
 var DEFAULT_MAX_WORDS = 12;
@@ -31780,7 +32105,9 @@ export {
   createVoiceToolContractJSONHandler,
   createVoiceToolContractHTMLHandler,
   createVoiceToolContract,
+  createVoiceTelnyxWebhookVerifier,
   createVoiceTelnyxCampaignDialer,
+  createVoiceTelephonyWebhookSecurityPreset,
   createVoiceTelephonyWebhookRoutes,
   createVoiceTelephonyWebhookHandler,
   createVoiceTelephonyOutcomePolicy,
@@ -31803,6 +32130,7 @@ export {
   createVoiceSTTProviderRouter,
   createVoiceSQLiteTraceSinkDeliveryStore,
   createVoiceSQLiteTraceEventStore,
+  createVoiceSQLiteTelnyxWebhookEventStore,
   createVoiceSQLiteTelephonyWebhookIdempotencyStore,
   createVoiceSQLiteTaskStore,
   createVoiceSQLiteSessionStore,
@@ -31820,6 +32148,7 @@ export {
   createVoiceRoutingDecisionSummary,
   createVoiceReviewSavedEvent,
   createVoiceResilienceRoutes,
+  createVoiceRedisTelnyxWebhookEventStore,
   createVoiceRedisTelephonyWebhookIdempotencyStore,
   createVoiceRedisTaskLeaseCoordinator,
   createVoiceRedisPlivoWebhookNonceStore,
@@ -31843,6 +32172,7 @@ export {
   createVoiceProductionReadinessRoutes,
   createVoicePostgresTraceSinkDeliveryStore,
   createVoicePostgresTraceEventStore,
+  createVoicePostgresTelnyxWebhookEventStore,
   createVoicePostgresTelephonyWebhookIdempotencyStore,
   createVoicePostgresTaskStore,
   createVoicePostgresSessionStore,
@@ -31998,6 +32328,7 @@ export {
   createOpenAIVoiceTTS,
   createOpenAIVoiceAssistantModel,
   createOpenAIRealtimeAdapter,
+  createMemoryVoiceTelnyxWebhookEventStore,
   createMemoryVoiceTelephonyWebhookIdempotencyStore,
   createMemoryVoicePlivoWebhookNonceStore,
   createJSONVoiceAssistantModel,

package/dist/telephony/security.d.ts

@@ -0,0 +1,95 @@
+import { type VoiceTelephonyWebhookIdempotencyStore, type VoiceTelephonyWebhookVerificationResult } from '../telephonyOutcome';
+import { type VoicePostgresClient } from '../postgresStore';
+import { type VoiceRedisTelephonyWebhookIdempotencyClient } from '../queue';
+import { type VoicePlivoWebhookNonceStore, type VoiceRedisPlivoWebhookNonceClient } from './plivo';
+import { type VoiceRedisTelnyxWebhookEventClient, type VoiceTelnyxWebhookEventStore } from './telnyx';
+export type VoiceTelephonyWebhookSecurityStorePreset = {
+    kind?: 'memory';
+} | {
+    kind: 'sqlite';
+    path: string;
+    tablePrefix?: string;
+} | {
+    connectionString?: string;
+    kind: 'postgres';
+    schemaName?: string;
+    sql?: VoicePostgresClient;
+    tablePrefix?: string;
+} | {
+    idempotencyClient?: VoiceRedisTelephonyWebhookIdempotencyClient;
+    keyPrefix?: string;
+    kind: 'redis';
+    plivoClient?: VoiceRedisPlivoWebhookNonceClient;
+    telnyxClient?: VoiceRedisTelnyxWebhookEventClient;
+    url?: string;
+};
+export type VoiceTelephonyWebhookSecurityOptions<TResult = unknown> = {
+    plivo?: {
+        authToken?: string;
+        nonceStore?: VoicePlivoWebhookNonceStore;
+        verificationUrl?: string | ((input: {
+            query: Record<string, unknown>;
+            request: Request;
+        }) => string);
+    };
+    store?: VoiceTelephonyWebhookSecurityStorePreset;
+    telnyx?: {
+        eventStore?: VoiceTelnyxWebhookEventStore;
+        publicKey?: string;
+        toleranceSeconds?: number;
+    };
+    ttlSeconds?: number;
+    twilio?: {
+        authToken?: string;
+        idempotencyStore?: VoiceTelephonyWebhookIdempotencyStore<TResult>;
+        verificationUrl?: string | ((input: {
+            query: Record<string, unknown>;
+            request: Request;
+        }) => string);
+    };
+};
+export type VoiceTelephonyWebhookSecurityPreset<TResult = unknown> = {
+    plivo: {
+        authToken?: string;
+        nonceStore: VoicePlivoWebhookNonceStore;
+        verify: (input: {
+            body: unknown;
+            headers: Headers;
+            query: Record<string, unknown>;
+            request: Request;
+        }) => Promise<VoiceTelephonyWebhookVerificationResult>;
+    };
+    telnyx: {
+        eventStore: VoiceTelnyxWebhookEventStore;
+        publicKey?: string;
+        toleranceSeconds?: number;
+        verify: (input: {
+            headers: Headers;
+            rawBody: string;
+        }) => Promise<VoiceTelephonyWebhookVerificationResult>;
+    };
+    twilio: {
+        idempotency: {
+            enabled: true;
+            store: VoiceTelephonyWebhookIdempotencyStore<TResult>;
+        };
+        requireVerification: true;
+        signingSecret?: string;
+        verificationUrl?: string | ((input: {
+            query: Record<string, unknown>;
+            request: Request;
+        }) => string);
+        verify: (input: {
+            body: unknown;
+            headers: Headers;
+            query: Record<string, unknown>;
+            request: Request;
+        }) => Promise<VoiceTelephonyWebhookVerificationResult>;
+    };
+    verify: {
+        plivo: VoiceTelephonyWebhookSecurityPreset<TResult>['plivo']['verify'];
+        telnyx: VoiceTelephonyWebhookSecurityPreset<TResult>['telnyx']['verify'];
+        twilio: VoiceTelephonyWebhookSecurityPreset<TResult>['twilio']['verify'];
+    };
+};
+export declare const createVoiceTelephonyWebhookSecurityPreset: <TResult = unknown>(options?: VoiceTelephonyWebhookSecurityOptions<TResult>) => VoiceTelephonyWebhookSecurityPreset<TResult>;

package/dist/telephony/telnyx.d.ts

@@ -1,8 +1,11 @@
+import { Database } from 'bun:sqlite';
+import type { RedisClient } from 'bun';
 import { Elysia } from 'elysia';
 import { type VoiceTelephonyContractReport, type VoiceTelephonySetupStatus, type VoiceTelephonySmokeCheck, type VoiceTelephonySmokeReport } from './contract';
 import { type VoiceTelephonyOutcomePolicy, type VoiceTelephonyWebhookRoutesOptions, type VoiceTelephonyWebhookVerificationResult } from '../telephonyOutcome';
 import type { VoiceServerMessage, VoiceSessionRecord } from '../types';
 import { type TwilioMediaStreamBridgeOptions } from './twilio';
+import type { VoicePostgresClient } from '../postgresStore';
 export type TelnyxMediaPayload = {
     chunk?: string;
     payload: string;
@@ -151,12 +154,45 @@ export type TelnyxVoiceRoutesOptions<TContext = unknown, TSession extends VoiceS
         }) => Promise<string> | string);
     };
     webhook?: Omit<VoiceTelephonyWebhookRoutesOptions<TContext, TSession, TResult>, 'context' | 'path' | 'policy' | 'provider'> & {
+        eventStore?: VoiceTelnyxWebhookEventStore;
         path?: string;
         policy?: VoiceTelephonyOutcomePolicy;
         publicKey?: string;
         toleranceSeconds?: number;
     };
 };
+export type VoiceTelnyxWebhookEventStore = {
+    claim?: (eventId: string) => Promise<boolean> | boolean;
+    has: (eventId: string) => Promise<boolean> | boolean;
+    set: (eventId: string) => Promise<void> | void;
+};
+export type VoiceTelnyxWebhookEventStoreOptions = {
+    ttlSeconds?: number;
+};
+export type VoiceSQLiteTelnyxWebhookEventStoreOptions = VoiceTelnyxWebhookEventStoreOptions & {
+    database?: Database;
+    path?: string;
+    tableName?: string;
+    tablePrefix?: string;
+};
+export type VoicePostgresTelnyxWebhookEventStoreOptions = VoiceTelnyxWebhookEventStoreOptions & {
+    connectionString?: string;
+    schemaName?: string;
+    sql?: VoicePostgresClient;
+    tableName?: string;
+    tablePrefix?: string;
+};
+export type VoiceRedisTelnyxWebhookEventClient = Pick<RedisClient, 'exists' | 'set'>;
+export type VoiceRedisTelnyxWebhookEventStoreOptions = VoiceTelnyxWebhookEventStoreOptions & {
+    client?: VoiceRedisTelnyxWebhookEventClient;
+    keyPrefix?: string;
+    url?: string;
+};
+export type VoiceTelnyxWebhookVerifierOptions = {
+    eventStore?: VoiceTelnyxWebhookEventStore;
+    publicKey?: string;
+    toleranceSeconds?: number;
+};
 export declare const createTelnyxVoiceResponse: (options: TelnyxVoiceResponseOptions) => string;
 export declare const createTelnyxMediaStreamBridge: <TContext = unknown, TSession extends VoiceSessionRecord = VoiceSessionRecord, TResult = unknown>(socket: TelnyxMediaStreamSocket, options: TelnyxMediaStreamBridgeOptions<TContext, TSession, TResult>) => TelnyxMediaStreamBridge;
 export declare const verifyVoiceTelnyxWebhookSignature: (input: {
@@ -165,6 +201,14 @@ export declare const verifyVoiceTelnyxWebhookSignature: (input: {
     publicKey?: string;
     toleranceSeconds?: number;
 }) => Promise<VoiceTelephonyWebhookVerificationResult>;
+export declare const createMemoryVoiceTelnyxWebhookEventStore: () => VoiceTelnyxWebhookEventStore;
+export declare const createVoiceSQLiteTelnyxWebhookEventStore: (options: VoiceSQLiteTelnyxWebhookEventStoreOptions) => VoiceTelnyxWebhookEventStore;
+export declare const createVoicePostgresTelnyxWebhookEventStore: (options?: VoicePostgresTelnyxWebhookEventStoreOptions) => VoiceTelnyxWebhookEventStore;
+export declare const createVoiceRedisTelnyxWebhookEventStore: (options?: VoiceRedisTelnyxWebhookEventStoreOptions) => VoiceTelnyxWebhookEventStore;
+export declare const createVoiceTelnyxWebhookVerifier: (options: VoiceTelnyxWebhookVerifierOptions) => (input: {
+    rawBody: string;
+    headers: Headers;
+}) => Promise<VoiceTelephonyWebhookVerificationResult>;
 export declare const createTelnyxVoiceRoutes: <TContext = unknown, TSession extends VoiceSessionRecord = VoiceSessionRecord, TResult = unknown>(options?: TelnyxVoiceRoutesOptions<TContext, TSession, TResult>) => Elysia<"", {
     decorator: {};
     store: {};

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@absolutejs/voice",
-	"version": "0.0.22-beta.271",
+	"version": "0.0.22-beta.273",
 	"description": "Voice primitives and Elysia plugin for AbsoluteJS",
 	"repository": {
 		"type": "git",