@absolutejs/voice 0.0.22-beta.663 → 0.0.22-beta.664

package/README.md

@@ -1454,6 +1454,11 @@ export const app = new Elysia()
           options: {
             context: {},
             outcomePolicy,
+            security: {
+              authToken: process.env.TWILIO_AUTH_TOKEN!,
+              expectedAccountSid: process.env.TWILIO_ACCOUNT_SID!,
+              publicOrigin: "https://voice.example.com",
+            },
             session: runtime.session,
             stt: deepgram({ apiKey: process.env.DEEPGRAM_API_KEY! }),
             streamPath: "/api/voice/twilio/stream",
@@ -4274,6 +4279,14 @@ await bridge.handleMessage(mediaMessageFromTwilio);
 
 The bridge also sends Twilio `clear` events on new inbound media after assistant audio has started streaming, so telephony barge-in can stop queued outbound playback.
 
+When mounting `createTwilioVoiceRoutes(...)` or the Twilio carrier in
+`createVoicePhoneAgent(...)`, `security` is required. The package validates
+signed GET/POST TwiML requests against the fixed `publicOrigin`, validates the
+Media Streams WebSocket signature, and can bind both ingress paths to
+`expectedAccountSid`. It never derives the signed URL from forwarded host or
+protocol headers. Set `streamVerificationUrl` only when the exact WebSocket URL
+Twilio signs differs from `wss://<publicOrigin><streamPath>`.
+
 ## Recommended Production Path
 
 The current best-performing path is:

package/dist/index.d.ts

@@ -292,7 +292,7 @@ export { evaluateVoiceTelephonyContract } from "./telephony/contract";
 export { createMemoryVoiceTelnyxWebhookEventStore, createTelnyxMediaStreamBridge, createTelnyxVoiceResponse, createTelnyxVoiceRoutes, createVoicePostgresTelnyxWebhookEventStore, createVoiceRedisTelnyxWebhookEventStore, createVoiceSQLiteTelnyxWebhookEventStore, createVoiceTelnyxWebhookVerifier, verifyVoiceTelnyxWebhookSignature, } from "./telephony/telnyx";
 export { createMemoryVoicePlivoWebhookNonceStore, createPlivoMediaStreamBridge, createPlivoVoiceResponse, createPlivoVoiceRoutes, createVoicePostgresPlivoWebhookNonceStore, createVoicePlivoWebhookVerifier, createVoiceRedisPlivoWebhookNonceStore, createVoiceSQLitePlivoWebhookNonceStore, signVoicePlivoWebhook, verifyVoicePlivoWebhookSignature, } from "./telephony/plivo";
 export { createVoiceTelephonyCarrierMatrix, createVoiceTelephonyCarrierMatrixRoutes, renderVoiceTelephonyCarrierMatrixHTML, } from "./telephony/matrix";
-export type { TwilioInboundMessage, TwilioMediaStreamBridge, TwilioMediaStreamBridgeOptions, TwilioMediaStreamSocket, TwilioOutboundClearMessage, TwilioOutboundMarkMessage, TwilioOutboundMediaMessage, TwilioOutboundMessage, TwilioVoiceRouteParameters, TwilioVoiceResponseOptions, TwilioVoiceSmokeCheck, TwilioVoiceSmokeOptions, TwilioVoiceSmokeReport, TwilioVoiceSetupOptions, TwilioVoiceSetupStatus, TwilioVoiceRoutesOptions, } from "./telephony/twilio";
+export type { TwilioInboundMessage, TwilioMediaStreamBridge, TwilioMediaStreamBridgeOptions, TwilioMediaStreamSocket, TwilioOutboundClearMessage, TwilioOutboundMarkMessage, TwilioOutboundMediaMessage, TwilioOutboundMessage, TwilioVoiceRouteParameters, TwilioVoiceResponseOptions, TwilioVoiceSmokeCheck, TwilioVoiceSmokeOptions, TwilioVoiceSmokeReport, TwilioVoiceSetupOptions, TwilioVoiceSetupStatus, TwilioVoiceRoutesOptions, TwilioVoiceSecurityOptions, } from "./telephony/twilio";
 export type { VoiceTelephonyWebhookSecurityOptions, VoiceTelephonyWebhookSecurityPreset, VoiceTelephonyWebhookSecurityAssertionInput, VoiceTelephonyWebhookSecurityAssertionReport, VoiceTelephonyWebhookSecurityProviderStatus, VoiceTelephonyWebhookSecurityReport, VoiceTelephonyWebhookSecurityRoutesOptions, VoiceTelephonyWebhookSecurityStorePreset, } from "./telephony/security";
 export type { VoiceTelephonyContractIssue, VoiceTelephonyContractOptions, VoiceTelephonyContractReport, VoiceTelephonyContractRequirement, VoiceTelephonyProvider, VoiceTelephonySetupStatus, VoiceTelephonySmokeCheck, VoiceTelephonySmokeReport, } from "./telephony/contract";
 export type { TelnyxInboundMessage, TelnyxMediaPayload, TelnyxMediaStreamBridge, TelnyxMediaStreamBridgeOptions, TelnyxMediaStreamSocket, TelnyxOutboundClearMessage, TelnyxOutboundMarkMessage, TelnyxOutboundMediaMessage, TelnyxOutboundMessage, TelnyxVoiceResponseOptions, TelnyxVoiceRoutesOptions, TelnyxVoiceSetupOptions, TelnyxVoiceSetupStatus, TelnyxVoiceSmokeCheck, TelnyxVoiceSmokeOptions, TelnyxVoiceSmokeReport, VoicePostgresTelnyxWebhookEventStoreOptions, VoiceRedisTelnyxWebhookEventClient, VoiceRedisTelnyxWebhookEventStoreOptions, VoiceSQLiteTelnyxWebhookEventStoreOptions, VoiceTelnyxWebhookEventStore, VoiceTelnyxWebhookEventStoreOptions, VoiceTelnyxWebhookVerifierOptions, } from "./telephony/telnyx";

package/dist/index.js

@@ -25346,13 +25346,20 @@ import { Elysia as Elysia37 } from "elysia";
 var TWILIO_MULAW_SAMPLE_RATE = 8000;
 var VOICE_PCM_SAMPLE_RATE = 16000;
 var escapeXml2 = (value) => value.replaceAll("&", "&amp;").replaceAll('"', "&quot;").replaceAll("'", "&apos;").replaceAll("<", "&lt;").replaceAll(">", "&gt;");
-var resolveRequestOrigin = (request) => {
-  const url = new URL(request.url);
-  const forwardedHost = request.headers.get("x-forwarded-host");
-  const forwardedProto = request.headers.get("x-forwarded-proto");
-  const host = forwardedHost ?? request.headers.get("host") ?? url.host;
-  const protocol = forwardedProto ?? url.protocol.replace(":", "");
-  return `${protocol}://${host}`;
+var TWILIO_ACCOUNT_SID = /^AC[0-9a-fA-F]{32}$/;
+var MAX_TWILIO_VOICE_BODY_BYTES = 64 * 1024;
+var resolveTwilioPublicOrigin = (security) => {
+  if (security.authToken.trim().length === 0) {
+    throw new Error("Twilio voice security.authToken must not be empty.");
+  }
+  if (security.expectedAccountSid !== undefined && !TWILIO_ACCOUNT_SID.test(security.expectedAccountSid)) {
+    throw new Error("Twilio voice security.expectedAccountSid must be an AC SID.");
+  }
+  const origin = new URL(security.publicOrigin);
+  if (origin.protocol !== "https:" || origin.pathname !== "/" || origin.search.length > 0 || origin.hash.length > 0) {
+    throw new Error("Twilio voice security.publicOrigin must be an HTTPS origin without a path, query, or fragment.");
+  }
+  return origin.origin;
 };
 var resolveTwilioStreamUrl = async (options, input) => {
   if (typeof options.twiml?.streamUrl === "function") {
@@ -25361,10 +25368,61 @@ var resolveTwilioStreamUrl = async (options, input) => {
   if (typeof options.twiml?.streamUrl === "string") {
     return options.twiml.streamUrl;
   }
-  const origin = resolveRequestOrigin(input.request);
+  const origin = resolveTwilioPublicOrigin(options.security);
   const wsOrigin = origin.replace(/^http:/, "ws:").replace(/^https:/, "wss:");
   return `${wsOrigin}${input.streamPath}`;
 };
+var resolveTrustedTwilioRequestUrl = (security, request) => {
+  const requestUrl = new URL(request.url);
+  return `${resolveTwilioPublicOrigin(security)}${requestUrl.pathname}${requestUrl.search}`;
+};
+var resolveTwilioSocketHeaders = (socket) => {
+  if (!socket.data || typeof socket.data !== "object")
+    return new Headers;
+  const data = socket.data;
+  for (const candidate of [data.request?.headers, data.headers]) {
+    if (!candidate)
+      continue;
+    if (typeof candidate === "object" && "get" in candidate && typeof candidate.get === "function") {
+      return candidate;
+    }
+    try {
+      return new Headers(candidate);
+    } catch {}
+  }
+  return new Headers;
+};
+var readTwilioVoiceForm = async (request) => {
+  const declaredLength = Number(request.headers.get("content-length"));
+  if (Number.isFinite(declaredLength) && declaredLength > MAX_TWILIO_VOICE_BODY_BYTES) {
+    throw new Response("Twilio request body is too large.", { status: 413 });
+  }
+  const contentType = request.headers.get("content-type") ?? "";
+  if (!contentType.includes("application/x-www-form-urlencoded")) {
+    throw new Response("Expected a form-encoded Twilio request.", {
+      status: 415
+    });
+  }
+  const text = await request.text();
+  if (Buffer3.byteLength(text, "utf8") > MAX_TWILIO_VOICE_BODY_BYTES) {
+    throw new Response("Twilio request body is too large.", { status: 413 });
+  }
+  return Object.fromEntries(new URLSearchParams(text));
+};
+var verifyTwilioVoiceRequest = async (request, security) => {
+  const body = request.method.toUpperCase() === "POST" ? await readTwilioVoiceForm(request.clone()) : {};
+  const verification = await verifyVoiceTwilioWebhookSignature({
+    authToken: security.authToken,
+    body,
+    headers: request.headers,
+    url: resolveTrustedTwilioRequestUrl(security, request)
+  });
+  const requestUrl = new URL(request.url);
+  const accountSid = typeof body.AccountSid === "string" ? body.AccountSid : requestUrl.searchParams.get("AccountSid");
+  return {
+    ok: verification.ok && (security.expectedAccountSid === undefined || accountSid === security.expectedAccountSid)
+  };
+};
 var resolveTwilioStreamParameters = async (parameters, input) => {
   if (typeof parameters === "function") {
     return parameters(input);
@@ -25382,7 +25440,7 @@ var getWebhookVerificationUrl = (webhook, input) => {
   return webhook.verificationUrl;
 };
 var buildTwilioVoiceSetupStatus = async (options, input) => {
-  const origin = resolveRequestOrigin(input.request);
+  const origin = resolveTwilioPublicOrigin(options.security);
   const stream = await resolveTwilioStreamUrl(options, input);
   const twiml = joinUrlPath(origin, input.twimlPath);
   const webhook = joinUrlPath(origin, input.webhookPath);
@@ -25466,8 +25524,13 @@ var runTwilioVoiceSmokeTest = async (input) => {
   const twimlUrl = new URL(setup.urls.twiml);
   twimlUrl.searchParams.set("scenarioId", input.options.smoke?.scenarioId ?? "smoke");
   twimlUrl.searchParams.set("sessionId", input.options.smoke?.sessionId ?? "smoke-session");
+  const twimlHeaders = new Headers(input.request.headers);
+  twimlHeaders.set("x-twilio-signature", await signVoiceTwilioWebhook({
+    authToken: input.options.security.authToken,
+    url: twimlUrl.toString()
+  }));
   const twimlResponse = await input.app.handle(new Request(twimlUrl, {
-    headers: input.request.headers
+    headers: twimlHeaders
   }));
   const twiml = await twimlResponse.text();
   const streamUrl = extractTwilioStreamUrl(twiml);
@@ -26056,45 +26119,32 @@ var createTwilioVoiceResponse = (options) => {
   return `<?xml version="1.0" encoding="UTF-8"?><Response><Connect><Stream url="${escapeXml2(options.streamUrl)}"${options.track ? ` track="${escapeXml2(options.track)}"` : ""}${options.streamName ? ` name="${escapeXml2(options.streamName)}"` : ""}>${parameters}</Stream></Connect></Response>`;
 };
 var createTwilioVoiceRoutes = (options) => {
+  resolveTwilioPublicOrigin(options.security);
   const streamPath = options.streamPath ?? "/api/voice/twilio/stream";
   const twimlPath = options.twiml?.path ?? "/api/voice/twilio";
   const webhookPath = options.webhook?.path ?? "/api/voice/twilio/webhook";
   const setupPath = options.setup?.path === false ? false : options.setup?.path ?? "/api/voice/twilio/setup";
   const smokePath = options.smoke?.path === false ? false : options.smoke?.path ?? "/api/voice/twilio/smoke";
   const bridges = new WeakMap;
+  const admittedSockets = new WeakSet;
+  const startedSockets = new WeakSet;
   const webhookPolicy = options.webhook?.policy ?? options.outcomePolicy ?? createVoiceTelephonyOutcomePolicy();
-  const app = new Elysia37({
-    name: options.name ?? "absolutejs-voice-twilio"
-  }).get(twimlPath, async ({ query, request }) => {
-    const streamUrl = await resolveTwilioStreamUrl(options, {
-      query,
-      request,
-      streamPath
-    });
-    const parameters = await resolveTwilioStreamParameters(options.twiml?.parameters, {
-      query,
-      request
-    });
-    return new Response(createTwilioVoiceResponse({
-      parameters,
-      streamName: options.twiml?.streamName,
-      streamUrl,
-      track: options.twiml?.track
-    }), {
-      headers: {
-        "content-type": "text/xml; charset=utf-8"
+  const renderTwiml = async (input) => {
+    try {
+      const verification = await verifyTwilioVoiceRequest(input.request, options.security);
+      if (!verification.ok) {
+        return new Response("Invalid Twilio signature.", { status: 403 });
       }
-    });
-  }).post(twimlPath, async ({ query, request }) => {
+    } catch (error) {
+      if (error instanceof Response)
+        return error;
+      throw error;
+    }
     const streamUrl = await resolveTwilioStreamUrl(options, {
-      query,
-      request,
+      ...input,
       streamPath
     });
-    const parameters = await resolveTwilioStreamParameters(options.twiml?.parameters, {
-      query,
-      request
-    });
+    const parameters = await resolveTwilioStreamParameters(options.twiml?.parameters, input);
     return new Response(createTwilioVoiceResponse({
       parameters,
       streamName: options.twiml?.streamName,
@@ -26105,15 +26155,45 @@ var createTwilioVoiceRoutes = (options) => {
         "content-type": "text/xml; charset=utf-8"
       }
     });
-  }).ws(streamPath, {
+  };
+  const streamVerificationUrl = options.security.streamVerificationUrl ?? `${resolveTwilioPublicOrigin(options.security).replace(/^https:/, "wss:")}${streamPath}`;
+  const app = new Elysia37({
+    name: options.name ?? "absolutejs-voice-twilio"
+  }).get(twimlPath, renderTwiml).post(twimlPath, renderTwiml, { parse: "none" }).ws(streamPath, {
     close: async (ws, _code, reason) => {
       const key = ws.raw ?? ws;
       const bridge = bridges.get(key);
       bridges.delete(key);
+      admittedSockets.delete(key);
+      startedSockets.delete(key);
       await bridge?.close(reason);
     },
     message: async (ws, raw) => {
       const key = ws.raw ?? ws;
+      if (!admittedSockets.has(key)) {
+        const verification = await verifyVoiceTwilioWebhookSignature({
+          authToken: options.security.authToken,
+          body: {},
+          headers: resolveTwilioSocketHeaders(ws),
+          url: streamVerificationUrl
+        });
+        if (!verification.ok) {
+          ws.close(4403, "invalid Twilio signature");
+          return;
+        }
+        admittedSockets.add(key);
+      }
+      const message = parseTwilioMessage(raw);
+      if (message.event === "start") {
+        if (startedSockets.has(key) || options.security.expectedAccountSid !== undefined && message.start.accountSid !== options.security.expectedAccountSid) {
+          ws.close(4403, "invalid Twilio stream start");
+          return;
+        }
+        startedSockets.add(key);
+      } else if (message.event !== "connected" && !startedSockets.has(key)) {
+        ws.close(4400, "Twilio stream must start before media");
+        return;
+      }
       let bridge = bridges.get(key);
       if (!bridge) {
         bridge = createTwilioMediaStreamBridge({
@@ -26206,7 +26286,7 @@ var createTwilioVoiceRoutes = (options) => {
 // src/telephony/plivo.ts
 var escapeXml3 = (value) => value.replaceAll("&", "&amp;").replaceAll('"', "&quot;").replaceAll("'", "&apos;").replaceAll("<", "&lt;").replaceAll(">", "&gt;");
 var joinUrlPath2 = (origin, path) => `${origin.replace(/\/$/, "")}${path.startsWith("/") ? path : `/${path}`}`;
-var resolveRequestOrigin2 = (request) => {
+var resolveRequestOrigin = (request) => {
   const url = new URL(request.url);
   const forwardedHost = request.headers.get("x-forwarded-host");
   const forwardedProto = request.headers.get("x-forwarded-proto");
@@ -26235,7 +26315,7 @@ var resolvePlivoStreamUrl = async (options, input) => {
   if (typeof options.answer?.streamUrl === "string") {
     return options.answer.streamUrl;
   }
-  const origin = resolveRequestOrigin2(input.request);
+  const origin = resolveRequestOrigin(input.request);
   const wsOrigin = origin.replace(/^http:/, "ws:").replace(/^https:/, "wss:");
   return `${wsOrigin}${input.streamPath}`;
 };
@@ -26604,7 +26684,7 @@ var createVoiceRedisPlivoWebhookNonceStore = (options = {}) => {
   };
 };
 var buildPlivoVoiceSetupStatus = async (options, input) => {
-  const origin = resolveRequestOrigin2(input.request);
+  const origin = resolveRequestOrigin(input.request);
   const stream = await resolvePlivoStreamUrl(options, input);
   const answer = joinUrlPath2(origin, input.answerPath);
   const webhook = joinUrlPath2(origin, input.webhookPath);
@@ -26856,7 +26936,7 @@ import { Database as Database4 } from "bun:sqlite";
 import { Elysia as Elysia39 } from "elysia";
 var escapeXml4 = (value) => value.replaceAll("&", "&amp;").replaceAll('"', "&quot;").replaceAll("'", "&apos;").replaceAll("<", "&lt;").replaceAll(">", "&gt;");
 var joinUrlPath3 = (origin, path) => `${origin.replace(/\/$/, "")}${path.startsWith("/") ? path : `/${path}`}`;
-var resolveRequestOrigin3 = (request) => {
+var resolveRequestOrigin2 = (request) => {
   const url = new URL(request.url);
   const forwardedHost = request.headers.get("x-forwarded-host");
   const forwardedProto = request.headers.get("x-forwarded-proto");
@@ -26878,7 +26958,7 @@ var resolveTelnyxStreamUrl = async (options, input) => {
   if (typeof options.texml?.streamUrl === "string") {
     return options.texml.streamUrl;
   }
-  const origin = resolveRequestOrigin3(input.request);
+  const origin = resolveRequestOrigin2(input.request);
   const wsOrigin = origin.replace(/^http:/, "ws:").replace(/^https:/, "wss:");
   return `${wsOrigin}${input.streamPath}`;
 };
@@ -27218,7 +27298,7 @@ var createVoiceTelnyxWebhookVerifier = (options) => async (input) => {
   return verification;
 };
 var buildTelnyxVoiceSetupStatus = async (options, input) => {
-  const origin = resolveRequestOrigin3(input.request);
+  const origin = resolveRequestOrigin2(input.request);
   const stream = await resolveTelnyxStreamUrl(options, input);
   const texml = joinUrlPath3(origin, input.texmlPath);
   const webhook = joinUrlPath3(origin, input.webhookPath);

package/dist/telephony/twilio.d.ts

@@ -225,6 +225,7 @@ export type TwilioVoiceSmokeOptions = {
 export type TwilioVoiceRoutesOptions<TContext = unknown, TSession extends VoiceSessionRecord = VoiceSessionRecord, TResult = unknown> = TwilioMediaStreamBridgeOptions<TContext, TSession, TResult> & {
     name?: string;
     outcomePolicy?: VoiceTelephonyOutcomePolicy;
+    security: TwilioVoiceSecurityOptions;
     smoke?: TwilioVoiceSmokeOptions;
     setup?: TwilioVoiceSetupOptions;
     streamPath?: string;
@@ -244,6 +245,16 @@ export type TwilioVoiceRoutesOptions<TContext = unknown, TSession extends VoiceS
         policy?: VoiceTelephonyOutcomePolicy;
     };
 };
+export type TwilioVoiceSecurityOptions = {
+    /** Twilio account Auth Token used only to validate inbound signatures. */
+    authToken: string;
+    /** Optional account binding for TwiML requests and Media Stream start events. */
+    expectedAccountSid?: string;
+    /** Fixed public HTTPS origin configured in Twilio. Proxy headers are never trusted. */
+    publicOrigin: string;
+    /** Exact WebSocket URL Twilio signs when it differs from the generated stream URL. */
+    streamVerificationUrl?: string;
+};
 export declare const decodeTwilioMulawBase64: (payload: string) => Int16Array<ArrayBuffer>;
 export declare const encodeTwilioMulawBase64: (samples: Int16Array) => string;
 export declare const transcodePCMToTwilioOutboundPayload: (chunk: Uint8Array, format: AudioFormat) => string;

package/dist/testing/index.js

@@ -15019,13 +15019,20 @@ var createVoiceTelephonyWebhookRoutes = (options = {}) => {
 var TWILIO_MULAW_SAMPLE_RATE = 8000;
 var VOICE_PCM_SAMPLE_RATE = 16000;
 var escapeXml2 = (value) => value.replaceAll("&", "&amp;").replaceAll('"', "&quot;").replaceAll("'", "&apos;").replaceAll("<", "&lt;").replaceAll(">", "&gt;");
-var resolveRequestOrigin = (request) => {
-  const url = new URL(request.url);
-  const forwardedHost = request.headers.get("x-forwarded-host");
-  const forwardedProto = request.headers.get("x-forwarded-proto");
-  const host = forwardedHost ?? request.headers.get("host") ?? url.host;
-  const protocol = forwardedProto ?? url.protocol.replace(":", "");
-  return `${protocol}://${host}`;
+var TWILIO_ACCOUNT_SID = /^AC[0-9a-fA-F]{32}$/;
+var MAX_TWILIO_VOICE_BODY_BYTES = 64 * 1024;
+var resolveTwilioPublicOrigin = (security) => {
+  if (security.authToken.trim().length === 0) {
+    throw new Error("Twilio voice security.authToken must not be empty.");
+  }
+  if (security.expectedAccountSid !== undefined && !TWILIO_ACCOUNT_SID.test(security.expectedAccountSid)) {
+    throw new Error("Twilio voice security.expectedAccountSid must be an AC SID.");
+  }
+  const origin = new URL(security.publicOrigin);
+  if (origin.protocol !== "https:" || origin.pathname !== "/" || origin.search.length > 0 || origin.hash.length > 0) {
+    throw new Error("Twilio voice security.publicOrigin must be an HTTPS origin without a path, query, or fragment.");
+  }
+  return origin.origin;
 };
 var resolveTwilioStreamUrl = async (options, input) => {
   if (typeof options.twiml?.streamUrl === "function") {
@@ -15034,10 +15041,61 @@ var resolveTwilioStreamUrl = async (options, input) => {
   if (typeof options.twiml?.streamUrl === "string") {
     return options.twiml.streamUrl;
   }
-  const origin = resolveRequestOrigin(input.request);
+  const origin = resolveTwilioPublicOrigin(options.security);
   const wsOrigin = origin.replace(/^http:/, "ws:").replace(/^https:/, "wss:");
   return `${wsOrigin}${input.streamPath}`;
 };
+var resolveTrustedTwilioRequestUrl = (security, request) => {
+  const requestUrl = new URL(request.url);
+  return `${resolveTwilioPublicOrigin(security)}${requestUrl.pathname}${requestUrl.search}`;
+};
+var resolveTwilioSocketHeaders = (socket) => {
+  if (!socket.data || typeof socket.data !== "object")
+    return new Headers;
+  const data = socket.data;
+  for (const candidate of [data.request?.headers, data.headers]) {
+    if (!candidate)
+      continue;
+    if (typeof candidate === "object" && "get" in candidate && typeof candidate.get === "function") {
+      return candidate;
+    }
+    try {
+      return new Headers(candidate);
+    } catch {}
+  }
+  return new Headers;
+};
+var readTwilioVoiceForm = async (request) => {
+  const declaredLength = Number(request.headers.get("content-length"));
+  if (Number.isFinite(declaredLength) && declaredLength > MAX_TWILIO_VOICE_BODY_BYTES) {
+    throw new Response("Twilio request body is too large.", { status: 413 });
+  }
+  const contentType = request.headers.get("content-type") ?? "";
+  if (!contentType.includes("application/x-www-form-urlencoded")) {
+    throw new Response("Expected a form-encoded Twilio request.", {
+      status: 415
+    });
+  }
+  const text = await request.text();
+  if (Buffer3.byteLength(text, "utf8") > MAX_TWILIO_VOICE_BODY_BYTES) {
+    throw new Response("Twilio request body is too large.", { status: 413 });
+  }
+  return Object.fromEntries(new URLSearchParams(text));
+};
+var verifyTwilioVoiceRequest = async (request, security) => {
+  const body = request.method.toUpperCase() === "POST" ? await readTwilioVoiceForm(request.clone()) : {};
+  const verification = await verifyVoiceTwilioWebhookSignature({
+    authToken: security.authToken,
+    body,
+    headers: request.headers,
+    url: resolveTrustedTwilioRequestUrl(security, request)
+  });
+  const requestUrl = new URL(request.url);
+  const accountSid = typeof body.AccountSid === "string" ? body.AccountSid : requestUrl.searchParams.get("AccountSid");
+  return {
+    ok: verification.ok && (security.expectedAccountSid === undefined || accountSid === security.expectedAccountSid)
+  };
+};
 var resolveTwilioStreamParameters = async (parameters, input) => {
   if (typeof parameters === "function") {
     return parameters(input);
@@ -15055,7 +15113,7 @@ var getWebhookVerificationUrl = (webhook, input) => {
   return webhook.verificationUrl;
 };
 var buildTwilioVoiceSetupStatus = async (options, input) => {
-  const origin = resolveRequestOrigin(input.request);
+  const origin = resolveTwilioPublicOrigin(options.security);
   const stream = await resolveTwilioStreamUrl(options, input);
   const twiml = joinUrlPath(origin, input.twimlPath);
   const webhook = joinUrlPath(origin, input.webhookPath);
@@ -15139,8 +15197,13 @@ var runTwilioVoiceSmokeTest = async (input) => {
   const twimlUrl = new URL(setup.urls.twiml);
   twimlUrl.searchParams.set("scenarioId", input.options.smoke?.scenarioId ?? "smoke");
   twimlUrl.searchParams.set("sessionId", input.options.smoke?.sessionId ?? "smoke-session");
+  const twimlHeaders = new Headers(input.request.headers);
+  twimlHeaders.set("x-twilio-signature", await signVoiceTwilioWebhook({
+    authToken: input.options.security.authToken,
+    url: twimlUrl.toString()
+  }));
   const twimlResponse = await input.app.handle(new Request(twimlUrl, {
-    headers: input.request.headers
+    headers: twimlHeaders
   }));
   const twiml = await twimlResponse.text();
   const streamUrl = extractTwilioStreamUrl(twiml);
@@ -15729,45 +15792,32 @@ var createTwilioVoiceResponse = (options) => {
   return `<?xml version="1.0" encoding="UTF-8"?><Response><Connect><Stream url="${escapeXml2(options.streamUrl)}"${options.track ? ` track="${escapeXml2(options.track)}"` : ""}${options.streamName ? ` name="${escapeXml2(options.streamName)}"` : ""}>${parameters}</Stream></Connect></Response>`;
 };
 var createTwilioVoiceRoutes = (options) => {
+  resolveTwilioPublicOrigin(options.security);
   const streamPath = options.streamPath ?? "/api/voice/twilio/stream";
   const twimlPath = options.twiml?.path ?? "/api/voice/twilio";
   const webhookPath = options.webhook?.path ?? "/api/voice/twilio/webhook";
   const setupPath = options.setup?.path === false ? false : options.setup?.path ?? "/api/voice/twilio/setup";
   const smokePath = options.smoke?.path === false ? false : options.smoke?.path ?? "/api/voice/twilio/smoke";
   const bridges = new WeakMap;
+  const admittedSockets = new WeakSet;
+  const startedSockets = new WeakSet;
   const webhookPolicy = options.webhook?.policy ?? options.outcomePolicy ?? createVoiceTelephonyOutcomePolicy();
-  const app = new Elysia6({
-    name: options.name ?? "absolutejs-voice-twilio"
-  }).get(twimlPath, async ({ query, request }) => {
-    const streamUrl = await resolveTwilioStreamUrl(options, {
-      query,
-      request,
-      streamPath
-    });
-    const parameters = await resolveTwilioStreamParameters(options.twiml?.parameters, {
-      query,
-      request
-    });
-    return new Response(createTwilioVoiceResponse({
-      parameters,
-      streamName: options.twiml?.streamName,
-      streamUrl,
-      track: options.twiml?.track
-    }), {
-      headers: {
-        "content-type": "text/xml; charset=utf-8"
+  const renderTwiml = async (input) => {
+    try {
+      const verification = await verifyTwilioVoiceRequest(input.request, options.security);
+      if (!verification.ok) {
+        return new Response("Invalid Twilio signature.", { status: 403 });
       }
-    });
-  }).post(twimlPath, async ({ query, request }) => {
+    } catch (error) {
+      if (error instanceof Response)
+        return error;
+      throw error;
+    }
     const streamUrl = await resolveTwilioStreamUrl(options, {
-      query,
-      request,
+      ...input,
       streamPath
     });
-    const parameters = await resolveTwilioStreamParameters(options.twiml?.parameters, {
-      query,
-      request
-    });
+    const parameters = await resolveTwilioStreamParameters(options.twiml?.parameters, input);
     return new Response(createTwilioVoiceResponse({
       parameters,
       streamName: options.twiml?.streamName,
@@ -15778,15 +15828,45 @@ var createTwilioVoiceRoutes = (options) => {
         "content-type": "text/xml; charset=utf-8"
       }
     });
-  }).ws(streamPath, {
+  };
+  const streamVerificationUrl = options.security.streamVerificationUrl ?? `${resolveTwilioPublicOrigin(options.security).replace(/^https:/, "wss:")}${streamPath}`;
+  const app = new Elysia6({
+    name: options.name ?? "absolutejs-voice-twilio"
+  }).get(twimlPath, renderTwiml).post(twimlPath, renderTwiml, { parse: "none" }).ws(streamPath, {
     close: async (ws, _code, reason) => {
       const key = ws.raw ?? ws;
       const bridge = bridges.get(key);
       bridges.delete(key);
+      admittedSockets.delete(key);
+      startedSockets.delete(key);
       await bridge?.close(reason);
     },
     message: async (ws, raw) => {
       const key = ws.raw ?? ws;
+      if (!admittedSockets.has(key)) {
+        const verification = await verifyVoiceTwilioWebhookSignature({
+          authToken: options.security.authToken,
+          body: {},
+          headers: resolveTwilioSocketHeaders(ws),
+          url: streamVerificationUrl
+        });
+        if (!verification.ok) {
+          ws.close(4403, "invalid Twilio signature");
+          return;
+        }
+        admittedSockets.add(key);
+      }
+      const message = parseTwilioMessage(raw);
+      if (message.event === "start") {
+        if (startedSockets.has(key) || options.security.expectedAccountSid !== undefined && message.start.accountSid !== options.security.expectedAccountSid) {
+          ws.close(4403, "invalid Twilio stream start");
+          return;
+        }
+        startedSockets.add(key);
+      } else if (message.event !== "connected" && !startedSockets.has(key)) {
+        ws.close(4400, "Twilio stream must start before media");
+        return;
+      }
       let bridge = bridges.get(key);
       if (!bridge) {
         bridge = createTwilioMediaStreamBridge({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@absolutejs/voice",
-  "version": "0.0.22-beta.663",
+  "version": "0.0.22-beta.664",
   "description": "Voice primitives and Elysia plugin for AbsoluteJS",
   "repository": {
     "type": "git",