@absolutejs/voice 0.0.22-beta.484 → 0.0.22-beta.485

package/dist/index.d.ts

@@ -80,6 +80,8 @@ export type { CreateVoiceCostAccountantOptions, VoiceCostAccountant, VoiceCostBr
 export { describeVoiceAssistantMode, resolveVoiceAssistantMode, } from "./assistantMode";
 export type { VoiceAssistantMode, VoiceAssistantModality, VoiceAssistantModeDescriptor, VoiceSemanticVADConfig, } from "./assistantMode";
 export { createPunctuationSemanticTurnDetector, createRegexSemanticTurnDetector, } from "./semanticTurn";
+export { VOICE_WEBHOOK_SIGNATURE_HEADER, VOICE_WEBHOOK_TIMESTAMP_HEADER, extractVoiceWebhookSignatureFromHeaders, signVoiceWebhookBody, verifyVoiceWebhookSignature, } from "./webhookVerification";
+export type { VoiceWebhookVerificationInput, VoiceWebhookVerificationReason, VoiceWebhookVerificationResult, } from "./webhookVerification";
 export type { CreatePunctuationSemanticTurnDetectorOptions, CreateRegexSemanticTurnDetectorOptions, VoiceSemanticTurnDetector, VoiceSemanticTurnInput, VoiceSemanticTurnVerdict, } from "./semanticTurn";
 export { createMonologueAMDDetector } from "./amdDetector";
 export type { MonologueAMDDetectorOptions, VoiceAMDDetector, VoiceAMDDetectorInput, VoiceAMDVerdict, } from "./amdDetector";

package/dist/index.js

@@ -35404,6 +35404,77 @@ var createRegexSemanticTurnDetector = (options) => {
     }
   };
 };
+// src/webhookVerification.ts
+var VOICE_WEBHOOK_SIGNATURE_HEADER = "x-absolutejs-signature";
+var VOICE_WEBHOOK_TIMESTAMP_HEADER = "x-absolutejs-timestamp";
+var toHex6 = (bytes) => Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
+var timingSafeEqual3 = (left, right) => {
+  if (left.length !== right.length) {
+    return false;
+  }
+  let result = 0;
+  for (let index = 0;index < left.length; index += 1) {
+    result |= left.charCodeAt(index) ^ right.charCodeAt(index);
+  }
+  return result === 0;
+};
+var computeSignature = async (input) => {
+  const encoder2 = new TextEncoder;
+  const key = await crypto.subtle.importKey("raw", encoder2.encode(input.secret), { hash: "SHA-256", name: "HMAC" }, false, ["sign"]);
+  const payload = encoder2.encode(`${input.timestamp}.${input.body}`);
+  const signature = await crypto.subtle.sign("HMAC", key, payload);
+  return `sha256=${toHex6(new Uint8Array(signature))}`;
+};
+var signVoiceWebhookBody = async (input) => computeSignature(input);
+var verifyVoiceWebhookSignature = async (input) => {
+  if (!input.secret) {
+    return { ok: false, reason: "missing-secret" };
+  }
+  if (!input.signature) {
+    return { ok: false, reason: "missing-signature" };
+  }
+  if (!input.signature.startsWith("sha256=")) {
+    return { ok: false, reason: "unsupported-algorithm" };
+  }
+  if (!input.timestamp) {
+    return { ok: false, reason: "missing-timestamp" };
+  }
+  const timestampMs = Number(input.timestamp);
+  const toleranceMs = Math.max(0, input.toleranceMs ?? 5 * 60 * 1000);
+  if (!Number.isFinite(timestampMs) || toleranceMs > 0 && Math.abs((input.now ?? Date.now()) - timestampMs) > toleranceMs) {
+    return { ok: false, reason: "stale-timestamp" };
+  }
+  const expected = await computeSignature({
+    body: input.body,
+    secret: input.secret,
+    timestamp: input.timestamp
+  });
+  if (!timingSafeEqual3(expected, input.signature)) {
+    return { ok: false, reason: "signature-mismatch" };
+  }
+  return { ok: true };
+};
+var extractVoiceWebhookSignatureFromHeaders = (headers) => {
+  const get = (name) => {
+    if (headers instanceof Headers) {
+      return headers.get(name);
+    }
+    const lowerTarget = name.toLowerCase();
+    for (const [key, value] of Object.entries(headers)) {
+      if (key.toLowerCase() === lowerTarget) {
+        if (Array.isArray(value)) {
+          return value[0] ?? null;
+        }
+        return value ?? null;
+      }
+    }
+    return null;
+  };
+  return {
+    signature: get(VOICE_WEBHOOK_SIGNATURE_HEADER),
+    timestamp: get(VOICE_WEBHOOK_TIMESTAMP_HEADER)
+  };
+};
 // src/amdDetector.ts
 var createMonologueAMDDetector = (options = {}) => {
   const minMonologueMs = options.minMonologueMs ?? 8000;
@@ -41951,7 +42022,7 @@ var createVoiceMemoryStore = () => {
 };
 // src/opsWebhook.ts
 import { Elysia as Elysia66 } from "elysia";
-var toHex6 = (bytes) => Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
+var toHex7 = (bytes) => Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
 var signVoiceOpsWebhookBody = async (input) => {
   const encoder2 = new TextEncoder;
   const key = await crypto.subtle.importKey("raw", encoder2.encode(input.secret), {
@@ -41959,9 +42030,9 @@ var signVoiceOpsWebhookBody = async (input) => {
     name: "HMAC"
   }, false, ["sign"]);
   const signature = await crypto.subtle.sign("HMAC", key, encoder2.encode(`${input.timestamp}.${input.body}`));
-  return `sha256=${toHex6(new Uint8Array(signature))}`;
+  return `sha256=${toHex7(new Uint8Array(signature))}`;
 };
-var timingSafeEqual3 = (left, right) => {
+var timingSafeEqual4 = (left, right) => {
   const encoder2 = new TextEncoder;
   const leftBytes = encoder2.encode(left);
   const rightBytes = encoder2.encode(right);
@@ -42068,7 +42139,7 @@ var verifyVoiceOpsWebhookSignature = async (input) => {
     secret: input.secret,
     timestamp: input.timestamp
   });
-  if (!timingSafeEqual3(expected, input.signature)) {
+  if (!timingSafeEqual4(expected, input.signature)) {
     return {
       ok: false,
       reason: "invalid-signature"
@@ -45977,6 +46048,7 @@ export {
   voiceGuardrailPolicyPresets,
   voiceComplianceRedactionDefaults,
   voice,
+  verifyVoiceWebhookSignature,
   verifyVoiceTwilioWebhookSignature,
   verifyVoiceTelnyxWebhookSignature,
   verifyVoicePlivoWebhookSignature,
@@ -46020,6 +46092,7 @@ export {
   summarizeVoiceAssistantRuns,
   summarizeVoiceAssistantHealth,
   startVoiceOpsTask,
+  signVoiceWebhookBody,
   signVoiceTwilioWebhook,
   signVoicePlivoWebhook,
   shapeTelephonyAssistantText,
@@ -46219,6 +46292,7 @@ export {
   filterVoiceAuditEvents,
   fetchVoiceProofTarget,
   failVoiceOpsTask,
+  extractVoiceWebhookSignatureFromHeaders,
   extractVoiceMediaPipelineIssueEntries,
   exportVoiceTrace,
   exportVoiceAuditTrail,
@@ -46765,6 +46839,8 @@ export {
   appendVoiceProviderRouterTraceEvent,
   appendVoiceIOProviderRouterTraceEvent,
   acknowledgeVoiceMonitorIssue,
+  VOICE_WEBHOOK_TIMESTAMP_HEADER,
+  VOICE_WEBHOOK_SIGNATURE_HEADER,
   VOICE_LIVE_OPS_ACTIONS,
   TURN_PROFILE_DEFAULTS,
   DEFAULT_VOICE_REDACTION_PATTERNS,

package/dist/webhookVerification.d.ts

@@ -0,0 +1,27 @@
+export type VoiceWebhookVerificationReason = "missing-secret" | "missing-signature" | "missing-timestamp" | "signature-mismatch" | "stale-timestamp" | "unsupported-algorithm";
+export type VoiceWebhookVerificationResult = {
+    ok: true;
+} | {
+    ok: false;
+    reason: VoiceWebhookVerificationReason;
+};
+export type VoiceWebhookVerificationInput = {
+    body: string;
+    now?: number;
+    secret?: string;
+    signature?: string | null;
+    timestamp?: string | null;
+    toleranceMs?: number;
+};
+export declare const VOICE_WEBHOOK_SIGNATURE_HEADER = "x-absolutejs-signature";
+export declare const VOICE_WEBHOOK_TIMESTAMP_HEADER = "x-absolutejs-timestamp";
+export declare const signVoiceWebhookBody: (input: {
+    body: string;
+    secret: string;
+    timestamp: string;
+}) => Promise<string>;
+export declare const verifyVoiceWebhookSignature: (input: VoiceWebhookVerificationInput) => Promise<VoiceWebhookVerificationResult>;
+export declare const extractVoiceWebhookSignatureFromHeaders: (headers: Headers | Record<string, string | string[] | undefined>) => {
+    signature: string | null;
+    timestamp: string | null;
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@absolutejs/voice",
-  "version": "0.0.22-beta.484",
+  "version": "0.0.22-beta.485",
   "description": "Voice primitives and Elysia plugin for AbsoluteJS",
   "repository": {
     "type": "git",