@absolutejs/voice 0.0.22-beta.273 → 0.0.22-beta.275

package/dist/index.d.ts

@@ -159,13 +159,13 @@ export type { VoiceS3ReviewStoreClient, VoiceS3ReviewStoreFile, VoiceS3ReviewSto
 export type { VoiceSQLiteRuntimeStorage, VoiceSQLiteStoreOptions } from './sqliteStore';
 export type { StoredVoiceIntegrationEvent, StoredVoiceExternalObjectMap, StoredVoiceOpsTask, VoiceExternalObjectMap, VoiceExternalObjectMapStore, VoiceOpsTaskAgeBucket, VoiceOpsTaskAnalyticsOptions, VoiceOpsTaskAnalyticsSummary, VoiceOpsTaskAssignmentRule, VoiceOpsTaskAssignmentRuleCondition, VoiceOpsTaskAssignmentRules, VoiceOpsTaskAssigneeAnalytics, VoiceOpsDispositionTaskPolicies, VoiceOpsSLABreachPolicy, VoiceIntegrationDeliveryStatus, VoiceIntegrationEvent, VoiceIntegrationEventStore, VoiceIntegrationSinkDelivery, VoiceIntegrationEventType, VoiceIntegrationWebhookConfig, VoiceOpsTask, VoiceOpsTaskHistoryEntry, VoiceOpsTaskKind, VoiceOpsTaskPolicy, VoiceOpsTaskPriority, VoiceOpsTaskStatus, VoiceOpsTaskStore, VoiceOpsTaskSummary, VoiceOpsTaskWorkerAnalytics } from './ops';
 export { createTwilioMediaStreamBridge, createTwilioVoiceRoutes, createTwilioVoiceResponse, decodeTwilioMulawBase64, encodeTwilioMulawBase64, transcodePCMToTwilioOutboundPayload, transcodeTwilioInboundPayloadToPCM16 } from './telephony/twilio';
-export { createVoiceTelephonyWebhookSecurityPreset } from './telephony/security';
+export { assertVoiceTelephonyWebhookSecurityEvidence, buildVoiceTelephonyWebhookSecurityReport, createVoiceTelephonyWebhookSecurityPreset, createVoiceTelephonyWebhookSecurityRoutes, evaluateVoiceTelephonyWebhookSecurityEvidence } from './telephony/security';
 export { evaluateVoiceTelephonyContract } from './telephony/contract';
 export { createMemoryVoiceTelnyxWebhookEventStore, createTelnyxMediaStreamBridge, createTelnyxVoiceResponse, createTelnyxVoiceRoutes, createVoicePostgresTelnyxWebhookEventStore, createVoiceRedisTelnyxWebhookEventStore, createVoiceSQLiteTelnyxWebhookEventStore, createVoiceTelnyxWebhookVerifier, verifyVoiceTelnyxWebhookSignature } from './telephony/telnyx';
 export { createMemoryVoicePlivoWebhookNonceStore, createPlivoMediaStreamBridge, createPlivoVoiceResponse, createPlivoVoiceRoutes, createVoicePostgresPlivoWebhookNonceStore, createVoicePlivoWebhookVerifier, createVoiceRedisPlivoWebhookNonceStore, createVoiceSQLitePlivoWebhookNonceStore, signVoicePlivoWebhook, verifyVoicePlivoWebhookSignature } from './telephony/plivo';
 export { createVoiceTelephonyCarrierMatrix, createVoiceTelephonyCarrierMatrixRoutes, renderVoiceTelephonyCarrierMatrixHTML } from './telephony/matrix';
 export type { TwilioInboundMessage, TwilioMediaStreamBridge, TwilioMediaStreamBridgeOptions, TwilioMediaStreamSocket, TwilioOutboundClearMessage, TwilioOutboundMarkMessage, TwilioOutboundMediaMessage, TwilioOutboundMessage, TwilioVoiceRouteParameters, TwilioVoiceResponseOptions, TwilioVoiceSmokeCheck, TwilioVoiceSmokeOptions, TwilioVoiceSmokeReport, TwilioVoiceSetupOptions, TwilioVoiceSetupStatus, TwilioVoiceRoutesOptions } from './telephony/twilio';
-export type { VoiceTelephonyWebhookSecurityOptions, VoiceTelephonyWebhookSecurityPreset, VoiceTelephonyWebhookSecurityStorePreset } from './telephony/security';
+export type { VoiceTelephonyWebhookSecurityOptions, VoiceTelephonyWebhookSecurityPreset, VoiceTelephonyWebhookSecurityAssertionInput, VoiceTelephonyWebhookSecurityAssertionReport, VoiceTelephonyWebhookSecurityProviderStatus, VoiceTelephonyWebhookSecurityReport, VoiceTelephonyWebhookSecurityRoutesOptions, VoiceTelephonyWebhookSecurityStorePreset } from './telephony/security';
 export type { VoiceTelephonyContractIssue, VoiceTelephonyContractOptions, VoiceTelephonyContractReport, VoiceTelephonyContractRequirement, VoiceTelephonyProvider, VoiceTelephonySetupStatus, VoiceTelephonySmokeCheck, VoiceTelephonySmokeReport } from './telephony/contract';
 export type { TelnyxInboundMessage, TelnyxMediaPayload, TelnyxMediaStreamBridge, TelnyxMediaStreamBridgeOptions, TelnyxMediaStreamSocket, TelnyxOutboundClearMessage, TelnyxOutboundMarkMessage, TelnyxOutboundMediaMessage, TelnyxOutboundMessage, TelnyxVoiceResponseOptions, TelnyxVoiceRoutesOptions, TelnyxVoiceSetupOptions, TelnyxVoiceSetupStatus, TelnyxVoiceSmokeCheck, TelnyxVoiceSmokeOptions, TelnyxVoiceSmokeReport, VoicePostgresTelnyxWebhookEventStoreOptions, VoiceRedisTelnyxWebhookEventClient, VoiceRedisTelnyxWebhookEventStoreOptions, VoiceSQLiteTelnyxWebhookEventStoreOptions, VoiceTelnyxWebhookEventStore, VoiceTelnyxWebhookEventStoreOptions, VoiceTelnyxWebhookVerifierOptions } from './telephony/telnyx';
 export type { PlivoInboundMessage, PlivoMediaStreamBridge, PlivoMediaStreamBridgeOptions, PlivoMediaStreamSocket, PlivoOutboundCheckpointMessage, PlivoOutboundClearAudioMessage, PlivoOutboundMessage, PlivoOutboundPlayAudioMessage, PlivoVoiceResponseOptions, PlivoVoiceRoutesOptions, PlivoVoiceSetupOptions, PlivoVoiceSetupStatus, PlivoVoiceSmokeCheck, PlivoVoiceSmokeOptions, PlivoVoiceSmokeReport, VoicePostgresPlivoWebhookNonceStoreOptions, VoicePlivoWebhookNonceStore, VoicePlivoWebhookNonceStoreOptions, VoicePlivoWebhookVerifierOptions, VoiceRedisPlivoWebhookNonceClient, VoiceRedisPlivoWebhookNonceStoreOptions, VoiceSQLitePlivoWebhookNonceStoreOptions } from './telephony/plivo';

package/dist/index.js

@@ -13757,6 +13757,17 @@ var buildRetentionPolicyFromQuery = (query, options) => ({
   scopes: parseRetentionScopes(query.scopes),
   traceFilter: typeof query.sessionId === "string" && query.sessionId.trim() ? { sessionId: query.sessionId } : undefined
 });
+var buildAuditFilterFromQuery = (query) => {
+  const filter = {
+    after: getNumberQuery(query.auditAfter),
+    afterOrAt: getNumberQuery(query.auditAfterOrAt),
+    before: getNumberQuery(query.auditBefore),
+    beforeOrAt: getNumberQuery(query.auditBeforeOrAt),
+    limit: getNumberQuery(query.auditLimit),
+    sessionId: typeof query.sessionId === "string" && query.sessionId.trim() ? query.sessionId : undefined
+  };
+  return Object.values(filter).some((value) => value !== undefined) ? filter : undefined;
+};
 var parseRetentionPolicyBody = (body, options, dryRun) => {
   const input = body && typeof body === "object" ? body : {};
   return {
@@ -13777,6 +13788,7 @@ var createVoiceDataControlRoutes = (options) => {
   });
   routes.get(path, async ({ query }) => {
     const report = await buildVoiceDataControlReport({
+      auditFilter: buildAuditFilterFromQuery(query),
       ...options,
       retention: buildRetentionPolicyFromQuery(query, options)
     });
@@ -13788,11 +13800,13 @@ var createVoiceDataControlRoutes = (options) => {
     });
   });
   routes.get(`${path}.json`, async ({ query }) => buildVoiceDataControlReport({
+    auditFilter: buildAuditFilterFromQuery(query),
     ...options,
     retention: buildRetentionPolicyFromQuery(query, options)
   }));
   routes.get(`${path}.md`, async ({ query }) => {
     const report = await buildVoiceDataControlReport({
+      auditFilter: buildAuditFilterFromQuery(query),
       ...options,
       retention: buildRetentionPolicyFromQuery(query, options)
     });
@@ -31665,6 +31679,7 @@ var createVoiceSTTRoutingCorrectionHandler = (mode = "generic") => {
   return createPhraseHintCorrectionHandler();
 };
 // src/telephony/security.ts
+import { Elysia as Elysia51 } from "elysia";
 var resolveVerificationUrl2 = (option, input) => typeof option === "function" ? option(input) : option ?? input.request.url;
 var createStores = (options) => {
   const ttlSeconds = options.ttlSeconds;
@@ -31746,6 +31761,135 @@ var createStores = (options) => {
     telnyx: options.telnyx?.eventStore ?? createMemoryVoiceTelnyxWebhookEventStore()
   };
 };
+var resolveStoreKind = (store) => store?.kind ?? "memory";
+var isPersistentStore = (store) => {
+  const kind = resolveStoreKind(store);
+  return kind === "postgres" || kind === "redis" || kind === "sqlite";
+};
+var providerStatus = (input) => {
+  const issues = [];
+  if (input.enabled && !input.checks.verification) {
+    issues.push("Webhook verification is not configured.");
+  }
+  if (input.enabled && !input.checks.replayProtection) {
+    issues.push("Replay protection is not configured.");
+  }
+  if (input.enabled && input.checks.idempotency === false) {
+    issues.push("Webhook idempotency is not configured.");
+  }
+  if (input.enabled && !input.checks.persistentStore) {
+    issues.push("Webhook security store is in-memory; use SQLite, Postgres, or Redis for production.");
+  }
+  return {
+    ...input,
+    issues,
+    status: !input.enabled ? "warn" : issues.length === 0 ? "pass" : "fail"
+  };
+};
+var buildVoiceTelephonyWebhookSecurityReport = (options = {}) => {
+  const store = resolveStoreKind(options.store);
+  const persistentStore = isPersistentStore(options.store);
+  const providers = [
+    providerStatus({
+      checks: {
+        idempotency: Boolean(options.twilio),
+        persistentStore,
+        replayProtection: Boolean(options.twilio),
+        verification: Boolean(options.twilio?.authToken)
+      },
+      enabled: Boolean(options.twilio),
+      provider: "twilio",
+      store
+    }),
+    providerStatus({
+      checks: {
+        persistentStore,
+        replayProtection: Boolean(options.telnyx),
+        verification: Boolean(options.telnyx?.publicKey)
+      },
+      enabled: Boolean(options.telnyx),
+      provider: "telnyx",
+      store
+    }),
+    providerStatus({
+      checks: {
+        persistentStore,
+        replayProtection: Boolean(options.plivo),
+        verification: Boolean(options.plivo?.authToken)
+      },
+      enabled: Boolean(options.plivo),
+      provider: "plivo",
+      store
+    })
+  ];
+  const enabled = providers.filter((provider) => provider.enabled);
+  const failed = enabled.filter((provider) => provider.status === "fail").length;
+  const warned = enabled.filter((provider) => provider.status === "warn").length;
+  const passed = enabled.filter((provider) => provider.status === "pass").length;
+  const status = failed > 0 ? "fail" : warned > 0 || enabled.length === 0 ? "warn" : "pass";
+  return {
+    generatedAt: Date.now(),
+    ok: status === "pass",
+    providers,
+    status,
+    summary: {
+      enabled: enabled.length,
+      failed,
+      passed,
+      warned
+    }
+  };
+};
+var evaluateVoiceTelephonyWebhookSecurityEvidence = (report, input = {}) => {
+  const issues = [...report.providers.flatMap((provider) => provider.issues)];
+  const enabledProviders = report.providers.filter((provider) => provider.enabled).map((provider) => provider.provider);
+  const passingProviders = report.providers.filter((provider) => provider.enabled && provider.status === "pass").map((provider) => provider.provider);
+  const failedProviders = report.providers.filter((provider) => provider.enabled && provider.status === "fail").map((provider) => provider.provider);
+  const maxFailedProviders = input.maxFailedProviders ?? 0;
+  const minEnabledProviders = input.minEnabledProviders ?? 1;
+  const requirePersistentStores = input.requirePersistentStores ?? true;
+  if (enabledProviders.length < minEnabledProviders) {
+    issues.push(`Expected at least ${String(minEnabledProviders)} enabled telephony webhook provider(s), found ${String(enabledProviders.length)}.`);
+  }
+  if (failedProviders.length > maxFailedProviders) {
+    issues.push(`Expected at most ${String(maxFailedProviders)} failing telephony webhook provider(s), found ${String(failedProviders.length)}.`);
+  }
+  for (const provider of input.requiredProviders ?? []) {
+    if (!enabledProviders.includes(provider)) {
+      issues.push(`Missing enabled telephony webhook provider: ${provider}.`);
+    }
+    if (!passingProviders.includes(provider)) {
+      issues.push(`Telephony webhook provider is not passing: ${provider}.`);
+    }
+  }
+  if (requirePersistentStores) {
+    for (const provider of report.providers) {
+      if (provider.enabled && !provider.checks.persistentStore) {
+        issues.push(`Telephony webhook provider ${provider.provider} is not using a persistent security store.`);
+      }
+    }
+  }
+  return {
+    failedProviders,
+    issues,
+    ok: issues.length === 0,
+    passingProviders,
+    status: report.status
+  };
+};
+var assertVoiceTelephonyWebhookSecurityEvidence = (report, input = {}) => {
+  const assertion = evaluateVoiceTelephonyWebhookSecurityEvidence(report, input);
+  if (!assertion.ok) {
+    throw new Error(`Voice telephony webhook security assertion failed: ${assertion.issues.join(" ")}`);
+  }
+  return assertion;
+};
+var createVoiceTelephonyWebhookSecurityRoutes = (options) => {
+  const path = options.path ?? "/api/voice/telephony/webhook-security";
+  return new Elysia51({
+    name: options.name ?? "absolutejs-voice-telephony-webhook-security"
+  }).get(path, () => buildVoiceTelephonyWebhookSecurityReport(options.options));
+};
 var createVoiceTelephonyWebhookSecurityPreset = (options = {}) => {
   const stores = createStores(options);
   const twilioVerificationUrl = options.twilio?.verificationUrl;
@@ -32030,6 +32174,7 @@ export {
   exportVoiceAuditTrail,
   evaluateVoiceTrace,
   evaluateVoiceToolContractEvidence,
+  evaluateVoiceTelephonyWebhookSecurityEvidence,
   evaluateVoiceTelephonyWebhookNormalizationEvidence,
   evaluateVoiceTelephonyContract,
   evaluateVoiceSimulationSuiteEvidence,
@@ -32107,6 +32252,7 @@ export {
   createVoiceToolContract,
   createVoiceTelnyxWebhookVerifier,
   createVoiceTelnyxCampaignDialer,
+  createVoiceTelephonyWebhookSecurityRoutes,
   createVoiceTelephonyWebhookSecurityPreset,
   createVoiceTelephonyWebhookRoutes,
   createVoiceTelephonyWebhookHandler,
@@ -32343,6 +32489,7 @@ export {
   claimVoiceOpsTask,
   buildVoiceTraceReplay,
   buildVoiceTraceDeliveryReport,
+  buildVoiceTelephonyWebhookSecurityReport,
   buildVoiceProviderSloReport,
   buildVoiceProviderContractMatrix,
   buildVoiceProofTrendReport,
@@ -32378,6 +32525,7 @@ export {
   buildEmptyVoiceProofTrendReport,
   assignVoiceOpsTask,
   assertVoiceToolContractEvidence,
+  assertVoiceTelephonyWebhookSecurityEvidence,
   assertVoiceTelephonyWebhookNormalizationEvidence,
   assertVoiceSimulationSuiteEvidence,
   assertVoiceProviderStackEvidence,

package/dist/telephony/security.d.ts

@@ -1,4 +1,5 @@
-import { type VoiceTelephonyWebhookIdempotencyStore, type VoiceTelephonyWebhookVerificationResult } from '../telephonyOutcome';
+import { type VoiceTelephonyWebhookIdempotencyStore, type VoiceTelephonyWebhookProvider, type VoiceTelephonyWebhookVerificationResult } from '../telephonyOutcome';
+import { Elysia } from 'elysia';
 import { type VoicePostgresClient } from '../postgresStore';
 import { type VoiceRedisTelephonyWebhookIdempotencyClient } from '../queue';
 import { type VoicePlivoWebhookNonceStore, type VoiceRedisPlivoWebhookNonceClient } from './plivo';
@@ -92,4 +93,90 @@ export type VoiceTelephonyWebhookSecurityPreset<TResult = unknown> = {
         twilio: VoiceTelephonyWebhookSecurityPreset<TResult>['twilio']['verify'];
     };
 };
+export type VoiceTelephonyWebhookSecurityProviderStatus = {
+    checks: {
+        idempotency?: boolean;
+        persistentStore: boolean;
+        replayProtection: boolean;
+        verification: boolean;
+    };
+    enabled: boolean;
+    issues: string[];
+    provider: VoiceTelephonyWebhookProvider;
+    status: 'fail' | 'pass' | 'warn';
+    store: VoiceTelephonyWebhookSecurityStorePreset['kind'] | 'memory';
+};
+export type VoiceTelephonyWebhookSecurityReport = {
+    generatedAt: number;
+    ok: boolean;
+    providers: VoiceTelephonyWebhookSecurityProviderStatus[];
+    status: 'fail' | 'pass' | 'warn';
+    summary: {
+        enabled: number;
+        failed: number;
+        passed: number;
+        warned: number;
+    };
+};
+export type VoiceTelephonyWebhookSecurityAssertionInput = {
+    maxFailedProviders?: number;
+    minEnabledProviders?: number;
+    requirePersistentStores?: boolean;
+    requiredProviders?: VoiceTelephonyWebhookProvider[];
+};
+export type VoiceTelephonyWebhookSecurityAssertionReport = {
+    failedProviders: VoiceTelephonyWebhookProvider[];
+    issues: string[];
+    ok: boolean;
+    passingProviders: VoiceTelephonyWebhookProvider[];
+    status: VoiceTelephonyWebhookSecurityReport['status'];
+};
+export type VoiceTelephonyWebhookSecurityRoutesOptions<TResult = unknown> = {
+    name?: string;
+    options: VoiceTelephonyWebhookSecurityOptions<TResult>;
+    path?: string;
+};
+export declare const buildVoiceTelephonyWebhookSecurityReport: <TResult = unknown>(options?: VoiceTelephonyWebhookSecurityOptions<TResult>) => VoiceTelephonyWebhookSecurityReport;
+export declare const evaluateVoiceTelephonyWebhookSecurityEvidence: (report: VoiceTelephonyWebhookSecurityReport, input?: VoiceTelephonyWebhookSecurityAssertionInput) => VoiceTelephonyWebhookSecurityAssertionReport;
+export declare const assertVoiceTelephonyWebhookSecurityEvidence: (report: VoiceTelephonyWebhookSecurityReport, input?: VoiceTelephonyWebhookSecurityAssertionInput) => VoiceTelephonyWebhookSecurityAssertionReport;
+export declare const createVoiceTelephonyWebhookSecurityRoutes: <TResult = unknown>(options: VoiceTelephonyWebhookSecurityRoutesOptions<TResult>) => Elysia<"", {
+    decorator: {};
+    store: {};
+    derive: {};
+    resolve: {};
+}, {
+    typebox: {};
+    error: {};
+}, {
+    schema: {};
+    standaloneSchema: {};
+    macro: {};
+    macroFn: {};
+    parser: {};
+    response: {};
+}, {
+    [x: string]: {
+        get: {
+            body: unknown;
+            params: {};
+            query: unknown;
+            headers: unknown;
+            response: {
+                200: VoiceTelephonyWebhookSecurityReport;
+            };
+        };
+    };
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}>;
 export declare const createVoiceTelephonyWebhookSecurityPreset: <TResult = unknown>(options?: VoiceTelephonyWebhookSecurityOptions<TResult>) => VoiceTelephonyWebhookSecurityPreset<TResult>;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@absolutejs/voice",
-	"version": "0.0.22-beta.273",
+	"version": "0.0.22-beta.275",
 	"description": "Voice primitives and Elysia plugin for AbsoluteJS",
 	"repository": {
 		"type": "git",