@absolutejs/voice 0.0.22-beta.663 → 0.0.22-beta.665

package/README.md

@@ -1454,6 +1454,11 @@ export const app = new Elysia()
           options: {
             context: {},
             outcomePolicy,
+            security: {
+              authToken: process.env.TWILIO_AUTH_TOKEN!,
+              expectedAccountSid: process.env.TWILIO_ACCOUNT_SID!,
+              publicOrigin: "https://voice.example.com",
+            },
             session: runtime.session,
             stt: deepgram({ apiKey: process.env.DEEPGRAM_API_KEY! }),
             streamPath: "/api/voice/twilio/stream",
@@ -4274,6 +4279,14 @@ await bridge.handleMessage(mediaMessageFromTwilio);
 
 The bridge also sends Twilio `clear` events on new inbound media after assistant audio has started streaming, so telephony barge-in can stop queued outbound playback.
 
+When mounting `createTwilioVoiceRoutes(...)` or the Twilio carrier in
+`createVoicePhoneAgent(...)`, `security` is required. The package validates
+signed GET/POST TwiML requests against the fixed `publicOrigin`, validates the
+Media Streams WebSocket signature, and can bind both ingress paths to
+`expectedAccountSid`. It never derives the signed URL from forwarded host or
+protocol headers. Set `streamVerificationUrl` only when the exact WebSocket URL
+Twilio signs differs from `wss://<publicOrigin><streamPath>`.
+
 ## Recommended Production Path
 
 The current best-performing path is:

package/dist/index.d.ts

@@ -292,7 +292,7 @@ export { evaluateVoiceTelephonyContract } from "./telephony/contract";
 export { createMemoryVoiceTelnyxWebhookEventStore, createTelnyxMediaStreamBridge, createTelnyxVoiceResponse, createTelnyxVoiceRoutes, createVoicePostgresTelnyxWebhookEventStore, createVoiceRedisTelnyxWebhookEventStore, createVoiceSQLiteTelnyxWebhookEventStore, createVoiceTelnyxWebhookVerifier, verifyVoiceTelnyxWebhookSignature, } from "./telephony/telnyx";
 export { createMemoryVoicePlivoWebhookNonceStore, createPlivoMediaStreamBridge, createPlivoVoiceResponse, createPlivoVoiceRoutes, createVoicePostgresPlivoWebhookNonceStore, createVoicePlivoWebhookVerifier, createVoiceRedisPlivoWebhookNonceStore, createVoiceSQLitePlivoWebhookNonceStore, signVoicePlivoWebhook, verifyVoicePlivoWebhookSignature, } from "./telephony/plivo";
 export { createVoiceTelephonyCarrierMatrix, createVoiceTelephonyCarrierMatrixRoutes, renderVoiceTelephonyCarrierMatrixHTML, } from "./telephony/matrix";
-export type { TwilioInboundMessage, TwilioMediaStreamBridge, TwilioMediaStreamBridgeOptions, TwilioMediaStreamSocket, TwilioOutboundClearMessage, TwilioOutboundMarkMessage, TwilioOutboundMediaMessage, TwilioOutboundMessage, TwilioVoiceRouteParameters, TwilioVoiceResponseOptions, TwilioVoiceSmokeCheck, TwilioVoiceSmokeOptions, TwilioVoiceSmokeReport, TwilioVoiceSetupOptions, TwilioVoiceSetupStatus, TwilioVoiceRoutesOptions, } from "./telephony/twilio";
+export type { TwilioInboundMessage, TwilioMediaStreamBridge, TwilioMediaStreamBridgeOptions, TwilioMediaStreamSocket, TwilioOutboundClearMessage, TwilioOutboundMarkMessage, TwilioOutboundMediaMessage, TwilioOutboundMessage, TwilioVoiceRouteParameters, TwilioVoiceResponseOptions, TwilioVoiceSmokeCheck, TwilioVoiceSmokeOptions, TwilioVoiceSmokeReport, TwilioVoiceSetupOptions, TwilioVoiceSetupStatus, TwilioVoiceRoutesOptions, TwilioVoiceSecurityOptions, } from "./telephony/twilio";
 export type { VoiceTelephonyWebhookSecurityOptions, VoiceTelephonyWebhookSecurityPreset, VoiceTelephonyWebhookSecurityAssertionInput, VoiceTelephonyWebhookSecurityAssertionReport, VoiceTelephonyWebhookSecurityProviderStatus, VoiceTelephonyWebhookSecurityReport, VoiceTelephonyWebhookSecurityRoutesOptions, VoiceTelephonyWebhookSecurityStorePreset, } from "./telephony/security";
 export type { VoiceTelephonyContractIssue, VoiceTelephonyContractOptions, VoiceTelephonyContractReport, VoiceTelephonyContractRequirement, VoiceTelephonyProvider, VoiceTelephonySetupStatus, VoiceTelephonySmokeCheck, VoiceTelephonySmokeReport, } from "./telephony/contract";
 export type { TelnyxInboundMessage, TelnyxMediaPayload, TelnyxMediaStreamBridge, TelnyxMediaStreamBridgeOptions, TelnyxMediaStreamSocket, TelnyxOutboundClearMessage, TelnyxOutboundMarkMessage, TelnyxOutboundMediaMessage, TelnyxOutboundMessage, TelnyxVoiceResponseOptions, TelnyxVoiceRoutesOptions, TelnyxVoiceSetupOptions, TelnyxVoiceSetupStatus, TelnyxVoiceSmokeCheck, TelnyxVoiceSmokeOptions, TelnyxVoiceSmokeReport, VoicePostgresTelnyxWebhookEventStoreOptions, VoiceRedisTelnyxWebhookEventClient, VoiceRedisTelnyxWebhookEventStoreOptions, VoiceSQLiteTelnyxWebhookEventStoreOptions, VoiceTelnyxWebhookEventStore, VoiceTelnyxWebhookEventStoreOptions, VoiceTelnyxWebhookVerifierOptions, } from "./telephony/telnyx";

package/dist/index.js

@@ -25346,13 +25346,20 @@ import { Elysia as Elysia37 } from "elysia";
 var TWILIO_MULAW_SAMPLE_RATE = 8000;
 var VOICE_PCM_SAMPLE_RATE = 16000;
 var escapeXml2 = (value) => value.replaceAll("&", "&amp;").replaceAll('"', "&quot;").replaceAll("'", "&apos;").replaceAll("<", "&lt;").replaceAll(">", "&gt;");
-var resolveRequestOrigin = (request) => {
-  const url = new URL(request.url);
-  const forwardedHost = request.headers.get("x-forwarded-host");
-  const forwardedProto = request.headers.get("x-forwarded-proto");
-  const host = forwardedHost ?? request.headers.get("host") ?? url.host;
-  const protocol = forwardedProto ?? url.protocol.replace(":", "");
-  return `${protocol}://${host}`;
+var TWILIO_ACCOUNT_SID = /^AC[0-9a-fA-F]{32}$/;
+var MAX_TWILIO_VOICE_BODY_BYTES = 64 * 1024;
+var resolveTwilioPublicOrigin = (security) => {
+  if (security.authToken.trim().length === 0) {
+    throw new Error("Twilio voice security.authToken must not be empty.");
+  }
+  if (security.expectedAccountSid !== undefined && !TWILIO_ACCOUNT_SID.test(security.expectedAccountSid)) {
+    throw new Error("Twilio voice security.expectedAccountSid must be an AC SID.");
+  }
+  const origin = new URL(security.publicOrigin);
+  if (origin.protocol !== "https:" || origin.pathname !== "/" || origin.search.length > 0 || origin.hash.length > 0) {
+    throw new Error("Twilio voice security.publicOrigin must be an HTTPS origin without a path, query, or fragment.");
+  }
+  return origin.origin;
 };
 var resolveTwilioStreamUrl = async (options, input) => {
   if (typeof options.twiml?.streamUrl === "function") {
@@ -25361,10 +25368,61 @@ var resolveTwilioStreamUrl = async (options, input) => {
   if (typeof options.twiml?.streamUrl === "string") {
     return options.twiml.streamUrl;
   }
-  const origin = resolveRequestOrigin(input.request);
+  const origin = resolveTwilioPublicOrigin(options.security);
   const wsOrigin = origin.replace(/^http:/, "ws:").replace(/^https:/, "wss:");
   return `${wsOrigin}${input.streamPath}`;
 };
+var resolveTrustedTwilioRequestUrl = (security, request) => {
+  const requestUrl = new URL(request.url);
+  return `${resolveTwilioPublicOrigin(security)}${requestUrl.pathname}${requestUrl.search}`;
+};
+var resolveTwilioSocketHeaders = (socket) => {
+  if (!socket.data || typeof socket.data !== "object")
+    return new Headers;
+  const data = socket.data;
+  for (const candidate of [data.request?.headers, data.headers]) {
+    if (!candidate)
+      continue;
+    if (typeof candidate === "object" && "get" in candidate && typeof candidate.get === "function") {
+      return candidate;
+    }
+    try {
+      return new Headers(candidate);
+    } catch {}
+  }
+  return new Headers;
+};
+var readTwilioVoiceForm = async (request) => {
+  const declaredLength = Number(request.headers.get("content-length"));
+  if (Number.isFinite(declaredLength) && declaredLength > MAX_TWILIO_VOICE_BODY_BYTES) {
+    throw new Response("Twilio request body is too large.", { status: 413 });
+  }
+  const contentType = request.headers.get("content-type") ?? "";
+  if (!contentType.includes("application/x-www-form-urlencoded")) {
+    throw new Response("Expected a form-encoded Twilio request.", {
+      status: 415
+    });
+  }
+  const text = await request.text();
+  if (Buffer3.byteLength(text, "utf8") > MAX_TWILIO_VOICE_BODY_BYTES) {
+    throw new Response("Twilio request body is too large.", { status: 413 });
+  }
+  return Object.fromEntries(new URLSearchParams(text));
+};
+var verifyTwilioVoiceRequest = async (request, security) => {
+  const body = request.method.toUpperCase() === "POST" ? await readTwilioVoiceForm(request.clone()) : {};
+  const verification = await verifyVoiceTwilioWebhookSignature({
+    authToken: security.authToken,
+    body,
+    headers: request.headers,
+    url: resolveTrustedTwilioRequestUrl(security, request)
+  });
+  const requestUrl = new URL(request.url);
+  const accountSid = typeof body.AccountSid === "string" ? body.AccountSid : requestUrl.searchParams.get("AccountSid");
+  return {
+    ok: verification.ok && (security.expectedAccountSid === undefined || accountSid === security.expectedAccountSid)
+  };
+};
 var resolveTwilioStreamParameters = async (parameters, input) => {
   if (typeof parameters === "function") {
     return parameters(input);
@@ -25382,7 +25440,7 @@ var getWebhookVerificationUrl = (webhook, input) => {
   return webhook.verificationUrl;
 };
 var buildTwilioVoiceSetupStatus = async (options, input) => {
-  const origin = resolveRequestOrigin(input.request);
+  const origin = resolveTwilioPublicOrigin(options.security);
   const stream = await resolveTwilioStreamUrl(options, input);
   const twiml = joinUrlPath(origin, input.twimlPath);
   const webhook = joinUrlPath(origin, input.webhookPath);
@@ -25466,8 +25524,13 @@ var runTwilioVoiceSmokeTest = async (input) => {
   const twimlUrl = new URL(setup.urls.twiml);
   twimlUrl.searchParams.set("scenarioId", input.options.smoke?.scenarioId ?? "smoke");
   twimlUrl.searchParams.set("sessionId", input.options.smoke?.sessionId ?? "smoke-session");
+  const twimlHeaders = new Headers(input.request.headers);
+  twimlHeaders.set("x-twilio-signature", await signVoiceTwilioWebhook({
+    authToken: input.options.security.authToken,
+    url: twimlUrl.toString()
+  }));
   const twimlResponse = await input.app.handle(new Request(twimlUrl, {
-    headers: input.request.headers
+    headers: twimlHeaders
   }));
   const twiml = await twimlResponse.text();
   const streamUrl = extractTwilioStreamUrl(twiml);
@@ -26056,45 +26119,32 @@ var createTwilioVoiceResponse = (options) => {
   return `<?xml version="1.0" encoding="UTF-8"?><Response><Connect><Stream url="${escapeXml2(options.streamUrl)}"${options.track ? ` track="${escapeXml2(options.track)}"` : ""}${options.streamName ? ` name="${escapeXml2(options.streamName)}"` : ""}>${parameters}</Stream></Connect></Response>`;
 };
 var createTwilioVoiceRoutes = (options) => {
+  resolveTwilioPublicOrigin(options.security);
   const streamPath = options.streamPath ?? "/api/voice/twilio/stream";
   const twimlPath = options.twiml?.path ?? "/api/voice/twilio";
   const webhookPath = options.webhook?.path ?? "/api/voice/twilio/webhook";
   const setupPath = options.setup?.path === false ? false : options.setup?.path ?? "/api/voice/twilio/setup";
   const smokePath = options.smoke?.path === false ? false : options.smoke?.path ?? "/api/voice/twilio/smoke";
   const bridges = new WeakMap;
+  const admittedSockets = new WeakSet;
+  const startedSockets = new WeakSet;
   const webhookPolicy = options.webhook?.policy ?? options.outcomePolicy ?? createVoiceTelephonyOutcomePolicy();
-  const app = new Elysia37({
-    name: options.name ?? "absolutejs-voice-twilio"
-  }).get(twimlPath, async ({ query, request }) => {
-    const streamUrl = await resolveTwilioStreamUrl(options, {
-      query,
-      request,
-      streamPath
-    });
-    const parameters = await resolveTwilioStreamParameters(options.twiml?.parameters, {
-      query,
-      request
-    });
-    return new Response(createTwilioVoiceResponse({
-      parameters,
-      streamName: options.twiml?.streamName,
-      streamUrl,
-      track: options.twiml?.track
-    }), {
-      headers: {
-        "content-type": "text/xml; charset=utf-8"
+  const renderTwiml = async (input) => {
+    try {
+      const verification = await verifyTwilioVoiceRequest(input.request, options.security);
+      if (!verification.ok) {
+        return new Response("Invalid Twilio signature.", { status: 403 });
       }
-    });
-  }).post(twimlPath, async ({ query, request }) => {
+    } catch (error) {
+      if (error instanceof Response)
+        return error;
+      throw error;
+    }
     const streamUrl = await resolveTwilioStreamUrl(options, {
-      query,
-      request,
+      ...input,
       streamPath
     });
-    const parameters = await resolveTwilioStreamParameters(options.twiml?.parameters, {
-      query,
-      request
-    });
+    const parameters = await resolveTwilioStreamParameters(options.twiml?.parameters, input);
     return new Response(createTwilioVoiceResponse({
       parameters,
       streamName: options.twiml?.streamName,
@@ -26105,15 +26155,45 @@ var createTwilioVoiceRoutes = (options) => {
         "content-type": "text/xml; charset=utf-8"
       }
     });
-  }).ws(streamPath, {
+  };
+  const streamVerificationUrl = options.security.streamVerificationUrl ?? `${resolveTwilioPublicOrigin(options.security).replace(/^https:/, "wss:")}${streamPath}`;
+  const app = new Elysia37({
+    name: options.name ?? "absolutejs-voice-twilio"
+  }).get(twimlPath, renderTwiml).post(twimlPath, renderTwiml, { parse: "none" }).ws(streamPath, {
     close: async (ws, _code, reason) => {
       const key = ws.raw ?? ws;
       const bridge = bridges.get(key);
       bridges.delete(key);
+      admittedSockets.delete(key);
+      startedSockets.delete(key);
       await bridge?.close(reason);
     },
     message: async (ws, raw) => {
       const key = ws.raw ?? ws;
+      if (!admittedSockets.has(key)) {
+        const verification = await verifyVoiceTwilioWebhookSignature({
+          authToken: options.security.authToken,
+          body: {},
+          headers: resolveTwilioSocketHeaders(ws),
+          url: streamVerificationUrl
+        });
+        if (!verification.ok) {
+          ws.close(4403, "invalid Twilio signature");
+          return;
+        }
+        admittedSockets.add(key);
+      }
+      const message = parseTwilioMessage(raw);
+      if (message.event === "start") {
+        if (startedSockets.has(key) || options.security.expectedAccountSid !== undefined && message.start.accountSid !== options.security.expectedAccountSid) {
+          ws.close(4403, "invalid Twilio stream start");
+          return;
+        }
+        startedSockets.add(key);
+      } else if (message.event !== "connected" && !startedSockets.has(key)) {
+        ws.close(4400, "Twilio stream must start before media");
+        return;
+      }
       let bridge = bridges.get(key);
       if (!bridge) {
         bridge = createTwilioMediaStreamBridge({
@@ -26206,7 +26286,7 @@ var createTwilioVoiceRoutes = (options) => {
 // src/telephony/plivo.ts
 var escapeXml3 = (value) => value.replaceAll("&", "&amp;").replaceAll('"', "&quot;").replaceAll("'", "&apos;").replaceAll("<", "&lt;").replaceAll(">", "&gt;");
 var joinUrlPath2 = (origin, path) => `${origin.replace(/\/$/, "")}${path.startsWith("/") ? path : `/${path}`}`;
-var resolveRequestOrigin2 = (request) => {
+var resolveRequestOrigin = (request) => {
   const url = new URL(request.url);
   const forwardedHost = request.headers.get("x-forwarded-host");
   const forwardedProto = request.headers.get("x-forwarded-proto");
@@ -26235,7 +26315,7 @@ var resolvePlivoStreamUrl = async (options, input) => {
   if (typeof options.answer?.streamUrl === "string") {
     return options.answer.streamUrl;
   }
-  const origin = resolveRequestOrigin2(input.request);
+  const origin = resolveRequestOrigin(input.request);
   const wsOrigin = origin.replace(/^http:/, "ws:").replace(/^https:/, "wss:");
   return `${wsOrigin}${input.streamPath}`;
 };
@@ -26413,10 +26493,6 @@ var createMemoryVoicePlivoWebhookNonceStore = () => {
       }
       nonces.add(nonce);
       return true;
-    },
-    has: (nonce) => nonces.has(nonce),
-    set: (nonce) => {
-      nonces.add(nonce);
     }
   };
 };
@@ -26464,20 +26540,13 @@ var createVoiceSQLitePlivoWebhookNonceStore = (options) => {
 			expires_at INTEGER
 		)`);
   const pruneExpired = database.query(`DELETE FROM "${tableName}" WHERE expires_at IS NOT NULL AND expires_at <= ?1`);
-  const select = database.query(`SELECT nonce FROM "${tableName}" WHERE nonce = ?1 AND (expires_at IS NULL OR expires_at > ?2) LIMIT 1`);
   const insert = database.query(`INSERT OR IGNORE INTO "${tableName}" (nonce, created_at, expires_at) VALUES (?1, ?2, ?3)`);
-  const upsert = database.query(`INSERT INTO "${tableName}" (nonce, created_at, expires_at) VALUES (?1, ?2, ?3)
-		 ON CONFLICT(nonce) DO UPDATE SET expires_at = excluded.expires_at`);
   return {
     claim: (nonce) => {
       const now = Date.now();
       pruneExpired.run(now);
       const result = insert.run(nonce, now, getPlivoNonceExpiresAt(options.ttlSeconds));
       return result.changes > 0;
-    },
-    has: (nonce) => Boolean(select.get(nonce, Date.now())),
-    set: (nonce) => {
-      upsert.run(nonce, Date.now(), getPlivoNonceExpiresAt(options.ttlSeconds));
     }
   };
 };
@@ -26531,21 +26600,6 @@ var createVoicePostgresPlivoWebhookNonceStore = (options = {}) => {
 				 ON CONFLICT (nonce) DO NOTHING
 				 RETURNING nonce`, [nonce, Date.now(), getPlivoNonceExpiresAt(options.ttlSeconds)]);
       return rows.length > 0;
-    },
-    has: async (nonce) => {
-      await initialized;
-      const sql = await client;
-      const rows = await sql.unsafe(`SELECT nonce FROM ${qualifiedTableName}
-				 WHERE nonce = $1 AND (expires_at IS NULL OR expires_at > $2)
-				 LIMIT 1`, [nonce, Date.now()]);
-      return rows.length > 0;
-    },
-    set: async (nonce) => {
-      await initialized;
-      const sql = await client;
-      await sql.unsafe(`INSERT INTO ${qualifiedTableName} (nonce, created_at, expires_at)
-				 VALUES ($1, $2, $3)
-				 ON CONFLICT (nonce) DO UPDATE SET expires_at = EXCLUDED.expires_at`, [nonce, Date.now(), getPlivoNonceExpiresAt(options.ttlSeconds)]);
     }
   };
 };
@@ -26572,16 +26626,9 @@ var createVoicePlivoWebhookVerifier = (options) => async (input) => {
   if (!nonce) {
     return { ok: false, reason: "invalid-signature" };
   }
-  if (nonceStore.claim) {
-    if (!await nonceStore.claim(nonce)) {
-      return { ok: false, reason: "invalid-signature" };
-    }
-    return verification;
-  }
-  if (await nonceStore.has(nonce)) {
+  if (!await nonceStore.claim(nonce)) {
     return { ok: false, reason: "invalid-signature" };
   }
-  await nonceStore.set(nonce);
   return verification;
 };
 var createVoiceRedisPlivoWebhookNonceStore = (options = {}) => {
@@ -26596,15 +26643,11 @@ var createVoiceRedisPlivoWebhookNonceStore = (options = {}) => {
     return client.set(key, "1", ...nx ? ["NX"] : []);
   };
   return {
-    claim: async (nonce) => await setNonce(nonce, true) === "OK",
-    has: async (nonce) => Boolean(await client.exists(getPlivoRedisNonceKey(keyPrefix, nonce))),
-    set: async (nonce) => {
-      await setNonce(nonce, false);
-    }
+    claim: async (nonce) => await setNonce(nonce, true) === "OK"
   };
 };
 var buildPlivoVoiceSetupStatus = async (options, input) => {
-  const origin = resolveRequestOrigin2(input.request);
+  const origin = resolveRequestOrigin(input.request);
   const stream = await resolvePlivoStreamUrl(options, input);
   const answer = joinUrlPath2(origin, input.answerPath);
   const webhook = joinUrlPath2(origin, input.webhookPath);
@@ -26856,7 +26899,7 @@ import { Database as Database4 } from "bun:sqlite";
 import { Elysia as Elysia39 } from "elysia";
 var escapeXml4 = (value) => value.replaceAll("&", "&amp;").replaceAll('"', "&quot;").replaceAll("'", "&apos;").replaceAll("<", "&lt;").replaceAll(">", "&gt;");
 var joinUrlPath3 = (origin, path) => `${origin.replace(/\/$/, "")}${path.startsWith("/") ? path : `/${path}`}`;
-var resolveRequestOrigin3 = (request) => {
+var resolveRequestOrigin2 = (request) => {
   const url = new URL(request.url);
   const forwardedHost = request.headers.get("x-forwarded-host");
   const forwardedProto = request.headers.get("x-forwarded-proto");
@@ -26878,7 +26921,7 @@ var resolveTelnyxStreamUrl = async (options, input) => {
   if (typeof options.texml?.streamUrl === "string") {
     return options.texml.streamUrl;
   }
-  const origin = resolveRequestOrigin3(input.request);
+  const origin = resolveRequestOrigin2(input.request);
   const wsOrigin = origin.replace(/^http:/, "ws:").replace(/^https:/, "wss:");
   return `${wsOrigin}${input.streamPath}`;
 };
@@ -27012,10 +27055,6 @@ var createMemoryVoiceTelnyxWebhookEventStore = () => {
       }
       eventIds.add(eventId);
       return true;
-    },
-    has: (eventId) => eventIds.has(eventId),
-    set: (eventId) => {
-      eventIds.add(eventId);
     }
   };
 };
@@ -27065,20 +27104,13 @@ var createVoiceSQLiteTelnyxWebhookEventStore = (options) => {
 			expires_at INTEGER
 		)`);
   const pruneExpired = database.query(`DELETE FROM "${tableName}" WHERE expires_at IS NOT NULL AND expires_at <= ?1`);
-  const select = database.query(`SELECT event_id FROM "${tableName}" WHERE event_id = ?1 AND (expires_at IS NULL OR expires_at > ?2) LIMIT 1`);
   const insert = database.query(`INSERT OR IGNORE INTO "${tableName}" (event_id, created_at, expires_at) VALUES (?1, ?2, ?3)`);
-  const upsert = database.query(`INSERT INTO "${tableName}" (event_id, created_at, expires_at) VALUES (?1, ?2, ?3)
-		 ON CONFLICT(event_id) DO UPDATE SET expires_at = excluded.expires_at`);
   return {
     claim: (eventId) => {
       const now = Date.now();
       pruneExpired.run(now);
       const result = insert.run(eventId, now, getTelnyxEventExpiresAt(options.ttlSeconds));
       return result.changes > 0;
-    },
-    has: (eventId) => Boolean(select.get(eventId, Date.now())),
-    set: (eventId) => {
-      upsert.run(eventId, Date.now(), getTelnyxEventExpiresAt(options.ttlSeconds));
     }
   };
 };
@@ -27132,21 +27164,6 @@ var createVoicePostgresTelnyxWebhookEventStore = (options = {}) => {
 				 ON CONFLICT (event_id) DO NOTHING
 				 RETURNING event_id`, [eventId, Date.now(), getTelnyxEventExpiresAt(options.ttlSeconds)]);
       return rows.length > 0;
-    },
-    has: async (eventId) => {
-      await initialized;
-      const sql = await client;
-      const rows = await sql.unsafe(`SELECT event_id FROM ${qualifiedTableName}
-				 WHERE event_id = $1 AND (expires_at IS NULL OR expires_at > $2)
-				 LIMIT 1`, [eventId, Date.now()]);
-      return rows.length > 0;
-    },
-    set: async (eventId) => {
-      await initialized;
-      const sql = await client;
-      await sql.unsafe(`INSERT INTO ${qualifiedTableName} (event_id, created_at, expires_at)
-				 VALUES ($1, $2, $3)
-				 ON CONFLICT (event_id) DO UPDATE SET expires_at = EXCLUDED.expires_at`, [eventId, Date.now(), getTelnyxEventExpiresAt(options.ttlSeconds)]);
     }
   };
 };
@@ -27163,11 +27180,7 @@ var createVoiceRedisTelnyxWebhookEventStore = (options = {}) => {
     return client.set(key, "1", ...nx ? ["NX"] : []);
   };
   return {
-    claim: async (eventId) => await setEvent(eventId, true) === "OK",
-    has: async (eventId) => Boolean(await client.exists(getTelnyxRedisEventKey(keyPrefix, eventId))),
-    set: async (eventId) => {
-      await setEvent(eventId, false);
-    }
+    claim: async (eventId) => await setEvent(eventId, true) === "OK"
   };
 };
 var readTelnyxWebhookEventId = (rawBody) => {
@@ -27208,17 +27221,10 @@ var createVoiceTelnyxWebhookVerifier = (options) => async (input) => {
   if (!eventId) {
     return { ok: false, reason: "invalid-signature" };
   }
-  if (eventStore.claim) {
-    return await eventStore.claim(eventId) ? verification : { ok: false, reason: "invalid-signature" };
-  }
-  if (await eventStore.has(eventId)) {
-    return { ok: false, reason: "invalid-signature" };
-  }
-  await eventStore.set(eventId);
-  return verification;
+  return await eventStore.claim(eventId) ? verification : { ok: false, reason: "invalid-signature" };
 };
 var buildTelnyxVoiceSetupStatus = async (options, input) => {
-  const origin = resolveRequestOrigin3(input.request);
+  const origin = resolveRequestOrigin2(input.request);
   const stream = await resolveTelnyxStreamUrl(options, input);
   const texml = joinUrlPath3(origin, input.texmlPath);
   const webhook = joinUrlPath3(origin, input.webhookPath);

package/dist/telephony/plivo.d.ts

@@ -135,9 +135,8 @@ export type PlivoVoiceSmokeOptions = {
     title?: string;
 };
 export type VoicePlivoWebhookNonceStore = {
-    claim?: (nonce: string) => Promise<boolean> | boolean;
-    has: (nonce: string) => Promise<boolean> | boolean;
-    set: (nonce: string) => Promise<void> | void;
+    /** Atomically accepts an unseen signature nonce and rejects every replay. */
+    claim: (nonce: string) => Promise<boolean> | boolean;
 };
 export type VoicePlivoWebhookNonceStoreOptions = {
     ttlSeconds?: number;
@@ -155,7 +154,7 @@ export type VoicePostgresPlivoWebhookNonceStoreOptions = VoicePlivoWebhookNonceS
     tableName?: string;
     tablePrefix?: string;
 };
-export type VoiceRedisPlivoWebhookNonceClient = Pick<RedisClient, "exists" | "set">;
+export type VoiceRedisPlivoWebhookNonceClient = Pick<RedisClient, "set">;
 export type VoiceRedisPlivoWebhookNonceStoreOptions = VoicePlivoWebhookNonceStoreOptions & {
     client?: VoiceRedisPlivoWebhookNonceClient;
     keyPrefix?: string;

package/dist/telephony/telnyx.d.ts

@@ -162,9 +162,8 @@ export type TelnyxVoiceRoutesOptions<TContext = unknown, TSession extends VoiceS
     };
 };
 export type VoiceTelnyxWebhookEventStore = {
-    claim?: (eventId: string) => Promise<boolean> | boolean;
-    has: (eventId: string) => Promise<boolean> | boolean;
-    set: (eventId: string) => Promise<void> | void;
+    /** Atomically accepts an unseen event id and rejects every duplicate. */
+    claim: (eventId: string) => Promise<boolean> | boolean;
 };
 export type VoiceTelnyxWebhookEventStoreOptions = {
     ttlSeconds?: number;
@@ -182,7 +181,7 @@ export type VoicePostgresTelnyxWebhookEventStoreOptions = VoiceTelnyxWebhookEven
     tableName?: string;
     tablePrefix?: string;
 };
-export type VoiceRedisTelnyxWebhookEventClient = Pick<RedisClient, "exists" | "set">;
+export type VoiceRedisTelnyxWebhookEventClient = Pick<RedisClient, "set">;
 export type VoiceRedisTelnyxWebhookEventStoreOptions = VoiceTelnyxWebhookEventStoreOptions & {
     client?: VoiceRedisTelnyxWebhookEventClient;
     keyPrefix?: string;

package/dist/telephony/twilio.d.ts

@@ -225,6 +225,7 @@ export type TwilioVoiceSmokeOptions = {
 export type TwilioVoiceRoutesOptions<TContext = unknown, TSession extends VoiceSessionRecord = VoiceSessionRecord, TResult = unknown> = TwilioMediaStreamBridgeOptions<TContext, TSession, TResult> & {
     name?: string;
     outcomePolicy?: VoiceTelephonyOutcomePolicy;
+    security: TwilioVoiceSecurityOptions;
     smoke?: TwilioVoiceSmokeOptions;
     setup?: TwilioVoiceSetupOptions;
     streamPath?: string;
@@ -244,6 +245,16 @@ export type TwilioVoiceRoutesOptions<TContext = unknown, TSession extends VoiceS
         policy?: VoiceTelephonyOutcomePolicy;
     };
 };
+export type TwilioVoiceSecurityOptions = {
+    /** Twilio account Auth Token used only to validate inbound signatures. */
+    authToken: string;
+    /** Optional account binding for TwiML requests and Media Stream start events. */
+    expectedAccountSid?: string;
+    /** Fixed public HTTPS origin configured in Twilio. Proxy headers are never trusted. */
+    publicOrigin: string;
+    /** Exact WebSocket URL Twilio signs when it differs from the generated stream URL. */
+    streamVerificationUrl?: string;
+};
 export declare const decodeTwilioMulawBase64: (payload: string) => Int16Array<ArrayBuffer>;
 export declare const encodeTwilioMulawBase64: (samples: Int16Array) => string;
 export declare const transcodePCMToTwilioOutboundPayload: (chunk: Uint8Array, format: AudioFormat) => string;

package/dist/testing/index.js

@@ -15019,13 +15019,20 @@ var createVoiceTelephonyWebhookRoutes = (options = {}) => {
 var TWILIO_MULAW_SAMPLE_RATE = 8000;
 var VOICE_PCM_SAMPLE_RATE = 16000;
 var escapeXml2 = (value) => value.replaceAll("&", "&amp;").replaceAll('"', "&quot;").replaceAll("'", "&apos;").replaceAll("<", "&lt;").replaceAll(">", "&gt;");
-var resolveRequestOrigin = (request) => {
-  const url = new URL(request.url);
-  const forwardedHost = request.headers.get("x-forwarded-host");
-  const forwardedProto = request.headers.get("x-forwarded-proto");
-  const host = forwardedHost ?? request.headers.get("host") ?? url.host;
-  const protocol = forwardedProto ?? url.protocol.replace(":", "");
-  return `${protocol}://${host}`;
+var TWILIO_ACCOUNT_SID = /^AC[0-9a-fA-F]{32}$/;
+var MAX_TWILIO_VOICE_BODY_BYTES = 64 * 1024;
+var resolveTwilioPublicOrigin = (security) => {
+  if (security.authToken.trim().length === 0) {
+    throw new Error("Twilio voice security.authToken must not be empty.");
+  }
+  if (security.expectedAccountSid !== undefined && !TWILIO_ACCOUNT_SID.test(security.expectedAccountSid)) {
+    throw new Error("Twilio voice security.expectedAccountSid must be an AC SID.");
+  }
+  const origin = new URL(security.publicOrigin);
+  if (origin.protocol !== "https:" || origin.pathname !== "/" || origin.search.length > 0 || origin.hash.length > 0) {
+    throw new Error("Twilio voice security.publicOrigin must be an HTTPS origin without a path, query, or fragment.");
+  }
+  return origin.origin;
 };
 var resolveTwilioStreamUrl = async (options, input) => {
   if (typeof options.twiml?.streamUrl === "function") {
@@ -15034,10 +15041,61 @@ var resolveTwilioStreamUrl = async (options, input) => {
   if (typeof options.twiml?.streamUrl === "string") {
     return options.twiml.streamUrl;
   }
-  const origin = resolveRequestOrigin(input.request);
+  const origin = resolveTwilioPublicOrigin(options.security);
   const wsOrigin = origin.replace(/^http:/, "ws:").replace(/^https:/, "wss:");
   return `${wsOrigin}${input.streamPath}`;
 };
+var resolveTrustedTwilioRequestUrl = (security, request) => {
+  const requestUrl = new URL(request.url);
+  return `${resolveTwilioPublicOrigin(security)}${requestUrl.pathname}${requestUrl.search}`;
+};
+var resolveTwilioSocketHeaders = (socket) => {
+  if (!socket.data || typeof socket.data !== "object")
+    return new Headers;
+  const data = socket.data;
+  for (const candidate of [data.request?.headers, data.headers]) {
+    if (!candidate)
+      continue;
+    if (typeof candidate === "object" && "get" in candidate && typeof candidate.get === "function") {
+      return candidate;
+    }
+    try {
+      return new Headers(candidate);
+    } catch {}
+  }
+  return new Headers;
+};
+var readTwilioVoiceForm = async (request) => {
+  const declaredLength = Number(request.headers.get("content-length"));
+  if (Number.isFinite(declaredLength) && declaredLength > MAX_TWILIO_VOICE_BODY_BYTES) {
+    throw new Response("Twilio request body is too large.", { status: 413 });
+  }
+  const contentType = request.headers.get("content-type") ?? "";
+  if (!contentType.includes("application/x-www-form-urlencoded")) {
+    throw new Response("Expected a form-encoded Twilio request.", {
+      status: 415
+    });
+  }
+  const text = await request.text();
+  if (Buffer3.byteLength(text, "utf8") > MAX_TWILIO_VOICE_BODY_BYTES) {
+    throw new Response("Twilio request body is too large.", { status: 413 });
+  }
+  return Object.fromEntries(new URLSearchParams(text));
+};
+var verifyTwilioVoiceRequest = async (request, security) => {
+  const body = request.method.toUpperCase() === "POST" ? await readTwilioVoiceForm(request.clone()) : {};
+  const verification = await verifyVoiceTwilioWebhookSignature({
+    authToken: security.authToken,
+    body,
+    headers: request.headers,
+    url: resolveTrustedTwilioRequestUrl(security, request)
+  });
+  const requestUrl = new URL(request.url);
+  const accountSid = typeof body.AccountSid === "string" ? body.AccountSid : requestUrl.searchParams.get("AccountSid");
+  return {
+    ok: verification.ok && (security.expectedAccountSid === undefined || accountSid === security.expectedAccountSid)
+  };
+};
 var resolveTwilioStreamParameters = async (parameters, input) => {
   if (typeof parameters === "function") {
     return parameters(input);
@@ -15055,7 +15113,7 @@ var getWebhookVerificationUrl = (webhook, input) => {
   return webhook.verificationUrl;
 };
 var buildTwilioVoiceSetupStatus = async (options, input) => {
-  const origin = resolveRequestOrigin(input.request);
+  const origin = resolveTwilioPublicOrigin(options.security);
   const stream = await resolveTwilioStreamUrl(options, input);
   const twiml = joinUrlPath(origin, input.twimlPath);
   const webhook = joinUrlPath(origin, input.webhookPath);
@@ -15139,8 +15197,13 @@ var runTwilioVoiceSmokeTest = async (input) => {
   const twimlUrl = new URL(setup.urls.twiml);
   twimlUrl.searchParams.set("scenarioId", input.options.smoke?.scenarioId ?? "smoke");
   twimlUrl.searchParams.set("sessionId", input.options.smoke?.sessionId ?? "smoke-session");
+  const twimlHeaders = new Headers(input.request.headers);
+  twimlHeaders.set("x-twilio-signature", await signVoiceTwilioWebhook({
+    authToken: input.options.security.authToken,
+    url: twimlUrl.toString()
+  }));
   const twimlResponse = await input.app.handle(new Request(twimlUrl, {
-    headers: input.request.headers
+    headers: twimlHeaders
   }));
   const twiml = await twimlResponse.text();
   const streamUrl = extractTwilioStreamUrl(twiml);
@@ -15729,45 +15792,32 @@ var createTwilioVoiceResponse = (options) => {
   return `<?xml version="1.0" encoding="UTF-8"?><Response><Connect><Stream url="${escapeXml2(options.streamUrl)}"${options.track ? ` track="${escapeXml2(options.track)}"` : ""}${options.streamName ? ` name="${escapeXml2(options.streamName)}"` : ""}>${parameters}</Stream></Connect></Response>`;
 };
 var createTwilioVoiceRoutes = (options) => {
+  resolveTwilioPublicOrigin(options.security);
   const streamPath = options.streamPath ?? "/api/voice/twilio/stream";
   const twimlPath = options.twiml?.path ?? "/api/voice/twilio";
   const webhookPath = options.webhook?.path ?? "/api/voice/twilio/webhook";
   const setupPath = options.setup?.path === false ? false : options.setup?.path ?? "/api/voice/twilio/setup";
   const smokePath = options.smoke?.path === false ? false : options.smoke?.path ?? "/api/voice/twilio/smoke";
   const bridges = new WeakMap;
+  const admittedSockets = new WeakSet;
+  const startedSockets = new WeakSet;
   const webhookPolicy = options.webhook?.policy ?? options.outcomePolicy ?? createVoiceTelephonyOutcomePolicy();
-  const app = new Elysia6({
-    name: options.name ?? "absolutejs-voice-twilio"
-  }).get(twimlPath, async ({ query, request }) => {
-    const streamUrl = await resolveTwilioStreamUrl(options, {
-      query,
-      request,
-      streamPath
-    });
-    const parameters = await resolveTwilioStreamParameters(options.twiml?.parameters, {
-      query,
-      request
-    });
-    return new Response(createTwilioVoiceResponse({
-      parameters,
-      streamName: options.twiml?.streamName,
-      streamUrl,
-      track: options.twiml?.track
-    }), {
-      headers: {
-        "content-type": "text/xml; charset=utf-8"
+  const renderTwiml = async (input) => {
+    try {
+      const verification = await verifyTwilioVoiceRequest(input.request, options.security);
+      if (!verification.ok) {
+        return new Response("Invalid Twilio signature.", { status: 403 });
       }
-    });
-  }).post(twimlPath, async ({ query, request }) => {
+    } catch (error) {
+      if (error instanceof Response)
+        return error;
+      throw error;
+    }
     const streamUrl = await resolveTwilioStreamUrl(options, {
-      query,
-      request,
+      ...input,
       streamPath
     });
-    const parameters = await resolveTwilioStreamParameters(options.twiml?.parameters, {
-      query,
-      request
-    });
+    const parameters = await resolveTwilioStreamParameters(options.twiml?.parameters, input);
     return new Response(createTwilioVoiceResponse({
       parameters,
       streamName: options.twiml?.streamName,
@@ -15778,15 +15828,45 @@ var createTwilioVoiceRoutes = (options) => {
         "content-type": "text/xml; charset=utf-8"
       }
     });
-  }).ws(streamPath, {
+  };
+  const streamVerificationUrl = options.security.streamVerificationUrl ?? `${resolveTwilioPublicOrigin(options.security).replace(/^https:/, "wss:")}${streamPath}`;
+  const app = new Elysia6({
+    name: options.name ?? "absolutejs-voice-twilio"
+  }).get(twimlPath, renderTwiml).post(twimlPath, renderTwiml, { parse: "none" }).ws(streamPath, {
     close: async (ws, _code, reason) => {
       const key = ws.raw ?? ws;
       const bridge = bridges.get(key);
       bridges.delete(key);
+      admittedSockets.delete(key);
+      startedSockets.delete(key);
       await bridge?.close(reason);
     },
     message: async (ws, raw) => {
       const key = ws.raw ?? ws;
+      if (!admittedSockets.has(key)) {
+        const verification = await verifyVoiceTwilioWebhookSignature({
+          authToken: options.security.authToken,
+          body: {},
+          headers: resolveTwilioSocketHeaders(ws),
+          url: streamVerificationUrl
+        });
+        if (!verification.ok) {
+          ws.close(4403, "invalid Twilio signature");
+          return;
+        }
+        admittedSockets.add(key);
+      }
+      const message = parseTwilioMessage(raw);
+      if (message.event === "start") {
+        if (startedSockets.has(key) || options.security.expectedAccountSid !== undefined && message.start.accountSid !== options.security.expectedAccountSid) {
+          ws.close(4403, "invalid Twilio stream start");
+          return;
+        }
+        startedSockets.add(key);
+      } else if (message.event !== "connected" && !startedSockets.has(key)) {
+        ws.close(4400, "Twilio stream must start before media");
+        return;
+      }
       let bridge = bridges.get(key);
       if (!bridge) {
         bridge = createTwilioMediaStreamBridge({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@absolutejs/voice",
-  "version": "0.0.22-beta.663",
+  "version": "0.0.22-beta.665",
   "description": "Voice primitives and Elysia plugin for AbsoluteJS",
   "repository": {
     "type": "git",