@diegoaltoworks/talker 0.8.0 → 0.10.0

package/dist/core/logger.d.ts

@@ -2,7 +2,13 @@
  * Structured JSON logger
  *
  * Silent during tests unless DEBUG=true.
+ * Automatically redacts phone numbers in structured log data.
  */
+/**
+ * Redact a phone number, keeping only the last 4 digits.
+ * E.g. "+15551234567" -> "***4567"
+ */
+export declare function redactPhone(phone: string): string;
 export declare const logger: {
     info: (message: string, data?: Record<string, unknown>) => void;
     warn: (message: string, data?: Record<string, unknown>) => void;

package/dist/core/logger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/core/logger.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAuBH,eAAO,MAAM,MAAM;oBACD,MAAM,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;oBACtC,MAAM,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;qBACrC,MAAM,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CACxD,CAAC"}
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/core/logger.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAYH;;;GAGG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAKjD;AA+BD,eAAO,MAAM,MAAM;oBACD,MAAM,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;oBACtC,MAAM,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;qBACrC,MAAM,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CACxD,CAAC"}

package/dist/core/logger.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=logger.test.d.ts.map

package/dist/core/logger.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.test.d.ts","sourceRoot":"","sources":["../../src/core/logger.test.ts"],"names":[],"mappings":""}

package/dist/index.d.ts

@@ -58,5 +58,8 @@ export { persistFinalSession, persistSession } from "./db/persist";
 export type { SessionRecord, MessageRecord } from "./db/sessions";
 export { callRoutes } from "./routes/call";
 export { smsRoutes } from "./routes/sms";
-export { logger } from "./core/logger";
+export { logger, redactPhone } from "./core/logger";
+export { twilioSignatureMiddleware, validateTwilioSignature } from "./middleware/twilio-signature";
+export { rateLimitMiddleware } from "./middleware/rate-limit";
+export { inputSanitizeMiddleware } from "./middleware/input-sanitize";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAGH,OAAO,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAGjD,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACtD,YAAY,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGrD,YAAY,EACV,YAAY,EACZ,kBAAkB,EAClB,qBAAqB,EACrB,YAAY,EACZ,aAAa,EACb,gBAAgB,EAChB,OAAO,EACP,WAAW,EACX,cAAc,EACd,gBAAgB,EAChB,OAAO,GACR,MAAM,SAAS,CAAC;AAGjB,YAAY,EACV,cAAc,EACd,UAAU,EACV,kBAAkB,EAClB,SAAS,EACT,WAAW,EACX,iBAAiB,EACjB,kBAAkB,EAClB,WAAW,EACX,oBAAoB,EACpB,UAAU,EACV,eAAe,EACf,UAAU,GACX,MAAM,SAAS,CAAC;AAGjB,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EACL,SAAS,EACT,iBAAiB,EACjB,aAAa,EACb,YAAY,EACZ,WAAW,GACZ,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,kBAAkB,EAClB,UAAU,EACV,YAAY,EACZ,gBAAgB,EAChB,mBAAmB,EACnB,mBAAmB,EACnB,UAAU,EACV,iBAAiB,EACjB,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,eAAe,EACf,wBAAwB,EACxB,oBAAoB,EACpB,aAAa,EACb,aAAa,EACb,YAAY,EACZ,WAAW,GACZ,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,WAAW,EACX,QAAQ,EACR,aAAa,EACb,mBAAmB,EACnB,aAAa,EACb,YAAY,GACb,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAG/C,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAG5C,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAGlE,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAGzC,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAGH,OAAO,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAGjD,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACtD,YAAY,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGrD,YAAY,EACV,YAAY,EACZ,kBAAkB,EAClB,qBAAqB,EACrB,YAAY,EACZ,aAAa,EACb,gBAAgB,EAChB,OAAO,EACP,WAAW,EACX,cAAc,EACd,gBAAgB,EAChB,OAAO,GACR,MAAM,SAAS,CAAC;AAGjB,YAAY,EACV,cAAc,EACd,UAAU,EACV,kBAAkB,EAClB,SAAS,EACT,WAAW,EACX,iBAAiB,EACjB,kBAAkB,EAClB,WAAW,EACX,oBAAoB,EACpB,UAAU,EACV,eAAe,EACf,UAAU,GACX,MAAM,SAAS,CAAC;AAGjB,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EACL,SAAS,EACT,iBAAiB,EACjB,aAAa,EACb,YAAY,EACZ,WAAW,GACZ,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,kBAAkB,EAClB,UAAU,EACV,YAAY,EACZ,gBAAgB,EAChB,mBAAmB,EACnB,mBAAmB,EACnB,UAAU,EACV,iBAAiB,EACjB,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,eAAe,EACf,wBAAwB,EACxB,oBAAoB,EACpB,aAAa,EACb,aAAa,EACb,YAAY,EACZ,WAAW,GACZ,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,WAAW,EACX,QAAQ,EACR,aAAa,EACb,mBAAmB,EACnB,aAAa,EACb,YAAY,GACb,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAG/C,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAG5C,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAGlE,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAGzC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAGpD,OAAO,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AACnG,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC"}

package/dist/index.js

@@ -86,6 +86,7 @@ __export(index_exports, {
   getVoiceConfig: () => getVoiceConfig,
   incrementNoSpeechRetries: () => incrementNoSpeechRetries,
   initDbClient: () => initDbClient,
+  inputSanitizeMiddleware: () => inputSanitizeMiddleware,
   loadFlowsFromDirectory: () => loadFlowsFromDirectory,
   loadPhrases: () => loadPhrases,
   logger: () => logger,
@@ -95,6 +96,8 @@ __export(index_exports, {
   processFlow: () => processFlow,
   processIncoming: () => processIncoming,
   processOutgoing: () => processOutgoing,
+  rateLimitMiddleware: () => rateLimitMiddleware,
+  redactPhone: () => redactPhone,
   resetNoSpeechRetries: () => resetNoSpeechRetries,
   runMigrations: () => runMigrations,
   sayTwiml: () => sayTwiml,
@@ -107,7 +110,9 @@ __export(index_exports, {
   startCleanup: () => startCleanup,
   stopCleanup: () => stopCleanup,
   transferTwiml: () => transferTwiml,
-  updateFlowParams: () => updateFlowParams
+  twilioSignatureMiddleware: () => twilioSignatureMiddleware,
+  updateFlowParams: () => updateFlowParams,
+  validateTwilioSignature: () => validateTwilioSignature
 });
 module.exports = __toCommonJS(index_exports);
 
@@ -116,13 +121,31 @@ var isTestEnv = process.env.NODE_ENV === "test" || typeof Bun !== "undefined" &&
 var isDebug = process.env.DEBUG === "true";
 var isSilent = isTestEnv && !isDebug;
 var timestamp = () => (/* @__PURE__ */ new Date()).toISOString();
+function redactPhone(phone) {
+  if (!phone || phone === "unknown") return phone;
+  const digits = phone.replace(/\D/g, "");
+  if (digits.length <= 4) return "***";
+  return `***${digits.slice(-4)}`;
+}
+function redactData(data) {
+  if (!data) return data;
+  const redacted = {};
+  for (const [key, value] of Object.entries(data)) {
+    if ((key === "phoneNumber" || key === "phone") && typeof value === "string") {
+      redacted[key] = redactPhone(value);
+    } else {
+      redacted[key] = value;
+    }
+  }
+  return redacted;
+}
 var log = (level, message, data) => {
   if (isSilent) return;
   const entry = {
     timestamp: timestamp(),
     level,
     message,
-    ...data
+    ...redactData(data)
   };
   console.log(JSON.stringify(entry));
 };
@@ -553,6 +576,140 @@ function testModeDetectIntent(message) {
 // src/routes/call/index.ts
 var import_hono = require("hono");
 
+// src/middleware/input-sanitize.ts
+var DEFAULT_MAX_INPUT_LENGTH = 1e3;
+function truncateInput(input, maxLength) {
+  if (input.length <= maxLength) return input;
+  return input.substring(0, maxLength);
+}
+function inputSanitizeMiddleware(maxInputLength) {
+  const maxLen = maxInputLength ?? DEFAULT_MAX_INPUT_LENGTH;
+  return async (c, next) => {
+    const body = await c.req.parseBody();
+    let truncated = false;
+    if (typeof body.SpeechResult === "string" && body.SpeechResult.length > maxLen) {
+      logger.warn("input truncated: SpeechResult", {
+        original: body.SpeechResult.length,
+        max: maxLen
+      });
+      body.SpeechResult = truncateInput(body.SpeechResult, maxLen);
+      truncated = true;
+    }
+    if (typeof body.Body === "string" && body.Body.length > maxLen) {
+      logger.warn("input truncated: Body", {
+        original: body.Body.length,
+        max: maxLen
+      });
+      body.Body = truncateInput(body.Body, maxLen);
+      truncated = true;
+    }
+    if (truncated) {
+      c.set("sanitizedBody", body);
+    }
+    return next();
+  };
+}
+
+// src/middleware/rate-limit.ts
+var DEFAULT_MAX_REQUESTS = 30;
+var DEFAULT_WINDOW_MS = 6e4;
+var rateLimitStore = /* @__PURE__ */ new Map();
+var cleanupTimer2 = null;
+function ensureCleanup(windowMs) {
+  if (cleanupTimer2) return;
+  cleanupTimer2 = setInterval(() => {
+    const cutoff = Date.now() - windowMs * 2;
+    for (const [key, entry] of rateLimitStore) {
+      entry.timestamps = entry.timestamps.filter((t) => t > cutoff);
+      if (entry.timestamps.length === 0) {
+        rateLimitStore.delete(key);
+      }
+    }
+  }, windowMs);
+}
+function checkRateLimit(phoneNumber, maxRequests, windowMs) {
+  const now = Date.now();
+  const cutoff = now - windowMs;
+  let entry = rateLimitStore.get(phoneNumber);
+  if (!entry) {
+    entry = { timestamps: [] };
+    rateLimitStore.set(phoneNumber, entry);
+  }
+  entry.timestamps = entry.timestamps.filter((t) => t > cutoff);
+  if (entry.timestamps.length >= maxRequests) {
+    return false;
+  }
+  entry.timestamps.push(now);
+  return true;
+}
+function rateLimitMiddleware(config) {
+  const maxRequests = config?.maxRequests ?? DEFAULT_MAX_REQUESTS;
+  const windowMs = config?.windowMs ?? DEFAULT_WINDOW_MS;
+  ensureCleanup(windowMs);
+  return async (c, next) => {
+    const body = await c.req.parseBody();
+    const phoneNumber = (body.From || "unknown").trim();
+    if (!checkRateLimit(phoneNumber, maxRequests, windowMs)) {
+      logger.warn("rate limit exceeded", { phoneNumber, path: c.req.path });
+      const twiml = `<?xml version="1.0" encoding="UTF-8"?>
+<Response>
+    <Say>Please try again in a moment.</Say>
+</Response>`;
+      return c.text(twiml, 429, { "Content-Type": "text/xml" });
+    }
+    return next();
+  };
+}
+
+// src/middleware/twilio-signature.ts
+var import_node_crypto = require("node:crypto");
+function computeTwilioSignature(authToken, url, params) {
+  const sortedKeys = Object.keys(params).sort();
+  let data = url;
+  for (const key of sortedKeys) {
+    data += key + params[key];
+  }
+  return (0, import_node_crypto.createHmac)("sha1", authToken).update(data).digest("base64");
+}
+function validateTwilioSignature(authToken, signature, url, params) {
+  const expected = computeTwilioSignature(authToken, url, params);
+  if (expected.length !== signature.length) return false;
+  let mismatch = 0;
+  for (let i = 0; i < expected.length; i++) {
+    mismatch |= expected.charCodeAt(i) ^ signature.charCodeAt(i);
+  }
+  return mismatch === 0;
+}
+function twilioSignatureMiddleware(authToken, baseUrl) {
+  return async (c, next) => {
+    if (!authToken) {
+      return next();
+    }
+    const signature = c.req.header("x-twilio-signature");
+    if (!signature) {
+      logger.warn("rejected request: missing X-Twilio-Signature header", {
+        path: c.req.path
+      });
+      return c.text("", 403);
+    }
+    const requestUrl = baseUrl ? `${baseUrl.replace(/\/$/, "")}${c.req.path}` : c.req.url;
+    const body = await c.req.parseBody();
+    const params = {};
+    for (const [key, value] of Object.entries(body)) {
+      if (typeof value === "string") {
+        params[key] = value;
+      }
+    }
+    if (!validateTwilioSignature(authToken, signature, requestUrl, params)) {
+      logger.warn("rejected request: invalid Twilio signature", {
+        path: c.req.path
+      });
+      return c.text("", 403);
+    }
+    return next();
+  };
+}
+
 // src/core/errors.ts
 function getErrorMessage(error) {
   if (error instanceof Error) {
@@ -1488,9 +1645,10 @@ async function processCall(deps, registry, phoneNumber, speechResult) {
         deps.config.voices
       );
       const transferNumber = deps.config.transferNumber || "";
+      const escapedFlowResponse = escapeXml(flowResult.response);
       return `<?xml version="1.0" encoding="UTF-8"?>
 <Response>
-    <Say voice="${voice}" language="${lang}">${flowResult.response}</Say>
+    <Say voice="${voice}" language="${lang}">${escapedFlowResponse}</Say>
     <Dial>${transferNumber}</Dial>
 </Response>`;
     }
@@ -1583,6 +1741,12 @@ async function handleStatus(c) {
 // src/routes/call/index.ts
 function callRoutes(deps, registry) {
   const app = new import_hono.Hono();
+  app.use("/call/*", twilioSignatureMiddleware(deps.config.twilio?.authToken));
+  app.use("/call/*", rateLimitMiddleware(deps.config.rateLimit));
+  app.use("/call/*", inputSanitizeMiddleware(deps.config.maxInputLength));
+  app.post("/call", twilioSignatureMiddleware(deps.config.twilio?.authToken));
+  app.post("/call", rateLimitMiddleware(deps.config.rateLimit));
+  app.post("/call", inputSanitizeMiddleware(deps.config.maxInputLength));
   app.post("/call", (c) => handleInitialCall(c, deps.config));
   app.post("/call/respond", (c) => handleRespond(c, deps, registry));
   app.post("/call/answer", (c) => handleAnswer(c, deps.config));
@@ -1653,6 +1817,9 @@ async function handleIncomingSMS(c, deps, registry) {
 // src/routes/sms/index.ts
 function smsRoutes(deps, registry) {
   const app = new import_hono2.Hono();
+  app.post("/sms", twilioSignatureMiddleware(deps.config.twilio?.authToken));
+  app.post("/sms", rateLimitMiddleware(deps.config.rateLimit));
+  app.post("/sms", inputSanitizeMiddleware(deps.config.maxInputLength));
   app.post("/sms", (c) => handleIncomingSMS(c, deps, registry));
   app.get("/sms", (c) => c.text("SMS endpoint active"));
   return app;
@@ -1815,6 +1982,7 @@ async function sendSMS(config, to, message) {
   getVoiceConfig,
   incrementNoSpeechRetries,
   initDbClient,
+  inputSanitizeMiddleware,
   loadFlowsFromDirectory,
   loadPhrases,
   logger,
@@ -1824,6 +1992,8 @@ async function sendSMS(config, to, message) {
   processFlow,
   processIncoming,
   processOutgoing,
+  rateLimitMiddleware,
+  redactPhone,
   resetNoSpeechRetries,
   runMigrations,
   sayTwiml,
@@ -1836,5 +2006,7 @@ async function sendSMS(config, to, message) {
   startCleanup,
   stopCleanup,
   transferTwiml,
-  updateFlowParams
+  twilioSignatureMiddleware,
+  updateFlowParams,
+  validateTwilioSignature
 });

package/dist/index.mjs

@@ -48,13 +48,31 @@ var isTestEnv = process.env.NODE_ENV === "test" || typeof Bun !== "undefined" &&
 var isDebug = process.env.DEBUG === "true";
 var isSilent = isTestEnv && !isDebug;
 var timestamp = () => (/* @__PURE__ */ new Date()).toISOString();
+function redactPhone(phone) {
+  if (!phone || phone === "unknown") return phone;
+  const digits = phone.replace(/\D/g, "");
+  if (digits.length <= 4) return "***";
+  return `***${digits.slice(-4)}`;
+}
+function redactData(data) {
+  if (!data) return data;
+  const redacted = {};
+  for (const [key, value] of Object.entries(data)) {
+    if ((key === "phoneNumber" || key === "phone") && typeof value === "string") {
+      redacted[key] = redactPhone(value);
+    } else {
+      redacted[key] = value;
+    }
+  }
+  return redacted;
+}
 var log = (level, message, data) => {
   if (isSilent) return;
   const entry = {
     timestamp: timestamp(),
     level,
     message,
-    ...data
+    ...redactData(data)
   };
   console.log(JSON.stringify(entry));
 };
@@ -485,6 +503,140 @@ function testModeDetectIntent(message) {
 // src/routes/call/index.ts
 import { Hono } from "hono";
 
+// src/middleware/input-sanitize.ts
+var DEFAULT_MAX_INPUT_LENGTH = 1e3;
+function truncateInput(input, maxLength) {
+  if (input.length <= maxLength) return input;
+  return input.substring(0, maxLength);
+}
+function inputSanitizeMiddleware(maxInputLength) {
+  const maxLen = maxInputLength ?? DEFAULT_MAX_INPUT_LENGTH;
+  return async (c, next) => {
+    const body = await c.req.parseBody();
+    let truncated = false;
+    if (typeof body.SpeechResult === "string" && body.SpeechResult.length > maxLen) {
+      logger.warn("input truncated: SpeechResult", {
+        original: body.SpeechResult.length,
+        max: maxLen
+      });
+      body.SpeechResult = truncateInput(body.SpeechResult, maxLen);
+      truncated = true;
+    }
+    if (typeof body.Body === "string" && body.Body.length > maxLen) {
+      logger.warn("input truncated: Body", {
+        original: body.Body.length,
+        max: maxLen
+      });
+      body.Body = truncateInput(body.Body, maxLen);
+      truncated = true;
+    }
+    if (truncated) {
+      c.set("sanitizedBody", body);
+    }
+    return next();
+  };
+}
+
+// src/middleware/rate-limit.ts
+var DEFAULT_MAX_REQUESTS = 30;
+var DEFAULT_WINDOW_MS = 6e4;
+var rateLimitStore = /* @__PURE__ */ new Map();
+var cleanupTimer2 = null;
+function ensureCleanup(windowMs) {
+  if (cleanupTimer2) return;
+  cleanupTimer2 = setInterval(() => {
+    const cutoff = Date.now() - windowMs * 2;
+    for (const [key, entry] of rateLimitStore) {
+      entry.timestamps = entry.timestamps.filter((t) => t > cutoff);
+      if (entry.timestamps.length === 0) {
+        rateLimitStore.delete(key);
+      }
+    }
+  }, windowMs);
+}
+function checkRateLimit(phoneNumber, maxRequests, windowMs) {
+  const now = Date.now();
+  const cutoff = now - windowMs;
+  let entry = rateLimitStore.get(phoneNumber);
+  if (!entry) {
+    entry = { timestamps: [] };
+    rateLimitStore.set(phoneNumber, entry);
+  }
+  entry.timestamps = entry.timestamps.filter((t) => t > cutoff);
+  if (entry.timestamps.length >= maxRequests) {
+    return false;
+  }
+  entry.timestamps.push(now);
+  return true;
+}
+function rateLimitMiddleware(config) {
+  const maxRequests = config?.maxRequests ?? DEFAULT_MAX_REQUESTS;
+  const windowMs = config?.windowMs ?? DEFAULT_WINDOW_MS;
+  ensureCleanup(windowMs);
+  return async (c, next) => {
+    const body = await c.req.parseBody();
+    const phoneNumber = (body.From || "unknown").trim();
+    if (!checkRateLimit(phoneNumber, maxRequests, windowMs)) {
+      logger.warn("rate limit exceeded", { phoneNumber, path: c.req.path });
+      const twiml = `<?xml version="1.0" encoding="UTF-8"?>
+<Response>
+    <Say>Please try again in a moment.</Say>
+</Response>`;
+      return c.text(twiml, 429, { "Content-Type": "text/xml" });
+    }
+    return next();
+  };
+}
+
+// src/middleware/twilio-signature.ts
+import { createHmac } from "node:crypto";
+function computeTwilioSignature(authToken, url, params) {
+  const sortedKeys = Object.keys(params).sort();
+  let data = url;
+  for (const key of sortedKeys) {
+    data += key + params[key];
+  }
+  return createHmac("sha1", authToken).update(data).digest("base64");
+}
+function validateTwilioSignature(authToken, signature, url, params) {
+  const expected = computeTwilioSignature(authToken, url, params);
+  if (expected.length !== signature.length) return false;
+  let mismatch = 0;
+  for (let i = 0; i < expected.length; i++) {
+    mismatch |= expected.charCodeAt(i) ^ signature.charCodeAt(i);
+  }
+  return mismatch === 0;
+}
+function twilioSignatureMiddleware(authToken, baseUrl) {
+  return async (c, next) => {
+    if (!authToken) {
+      return next();
+    }
+    const signature = c.req.header("x-twilio-signature");
+    if (!signature) {
+      logger.warn("rejected request: missing X-Twilio-Signature header", {
+        path: c.req.path
+      });
+      return c.text("", 403);
+    }
+    const requestUrl = baseUrl ? `${baseUrl.replace(/\/$/, "")}${c.req.path}` : c.req.url;
+    const body = await c.req.parseBody();
+    const params = {};
+    for (const [key, value] of Object.entries(body)) {
+      if (typeof value === "string") {
+        params[key] = value;
+      }
+    }
+    if (!validateTwilioSignature(authToken, signature, requestUrl, params)) {
+      logger.warn("rejected request: invalid Twilio signature", {
+        path: c.req.path
+      });
+      return c.text("", 403);
+    }
+    return next();
+  };
+}
+
 // src/core/errors.ts
 function getErrorMessage(error) {
   if (error instanceof Error) {
@@ -1420,9 +1572,10 @@ async function processCall(deps, registry, phoneNumber, speechResult) {
         deps.config.voices
       );
       const transferNumber = deps.config.transferNumber || "";
+      const escapedFlowResponse = escapeXml(flowResult.response);
       return `<?xml version="1.0" encoding="UTF-8"?>
 <Response>
-    <Say voice="${voice}" language="${lang}">${flowResult.response}</Say>
+    <Say voice="${voice}" language="${lang}">${escapedFlowResponse}</Say>
     <Dial>${transferNumber}</Dial>
 </Response>`;
     }
@@ -1515,6 +1668,12 @@ async function handleStatus(c) {
 // src/routes/call/index.ts
 function callRoutes(deps, registry) {
   const app = new Hono();
+  app.use("/call/*", twilioSignatureMiddleware(deps.config.twilio?.authToken));
+  app.use("/call/*", rateLimitMiddleware(deps.config.rateLimit));
+  app.use("/call/*", inputSanitizeMiddleware(deps.config.maxInputLength));
+  app.post("/call", twilioSignatureMiddleware(deps.config.twilio?.authToken));
+  app.post("/call", rateLimitMiddleware(deps.config.rateLimit));
+  app.post("/call", inputSanitizeMiddleware(deps.config.maxInputLength));
   app.post("/call", (c) => handleInitialCall(c, deps.config));
   app.post("/call/respond", (c) => handleRespond(c, deps, registry));
   app.post("/call/answer", (c) => handleAnswer(c, deps.config));
@@ -1585,6 +1744,9 @@ async function handleIncomingSMS(c, deps, registry) {
 // src/routes/sms/index.ts
 function smsRoutes(deps, registry) {
   const app = new Hono2();
+  app.post("/sms", twilioSignatureMiddleware(deps.config.twilio?.authToken));
+  app.post("/sms", rateLimitMiddleware(deps.config.rateLimit));
+  app.post("/sms", inputSanitizeMiddleware(deps.config.maxInputLength));
   app.post("/sms", (c) => handleIncomingSMS(c, deps, registry));
   app.get("/sms", (c) => c.text("SMS endpoint active"));
   return app;
@@ -1746,6 +1908,7 @@ export {
   getVoiceConfig,
   incrementNoSpeechRetries,
   initDbClient,
+  inputSanitizeMiddleware,
   loadFlowsFromDirectory,
   loadPhrases,
   logger,
@@ -1755,6 +1918,8 @@ export {
   processFlow,
   processIncoming,
   processOutgoing,
+  rateLimitMiddleware,
+  redactPhone,
   resetNoSpeechRetries,
   runMigrations,
   sayTwiml,
@@ -1767,5 +1932,7 @@ export {
   startCleanup,
   stopCleanup,
   transferTwiml,
-  updateFlowParams
+  twilioSignatureMiddleware,
+  updateFlowParams,
+  validateTwilioSignature
 };

package/dist/middleware/input-sanitize.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Input Sanitization Middleware
+ *
+ * Enforces a maximum length on user-supplied input fields (SpeechResult, Body).
+ * Truncates silently rather than rejecting, since Twilio expects a TwiML response.
+ */
+import type { Context, Next } from "hono";
+/**
+ * Truncate a string to the max length, appending an ellipsis if truncated.
+ */
+export declare function truncateInput(input: string, maxLength: number): string;
+/**
+ * Hono middleware factory for input sanitization.
+ *
+ * Intercepts the request body and truncates SpeechResult and Body fields
+ * to the configured maximum length. Stores the sanitized values on the
+ * context so downstream handlers see the truncated values.
+ */
+export declare function inputSanitizeMiddleware(maxInputLength?: number): (c: Context, next: Next) => Promise<void>;
+//# sourceMappingURL=input-sanitize.d.ts.map

package/dist/middleware/input-sanitize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"input-sanitize.d.ts","sourceRoot":"","sources":["../../src/middleware/input-sanitize.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAK1C;;GAEG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAGtE;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,cAAc,CAAC,EAAE,MAAM,IAG/C,GAAG,OAAO,EAAE,MAAM,IAAI,mBA6BrC"}

package/dist/middleware/input-sanitize.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=input-sanitize.test.d.ts.map

package/dist/middleware/input-sanitize.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"input-sanitize.test.d.ts","sourceRoot":"","sources":["../../src/middleware/input-sanitize.test.ts"],"names":[],"mappings":""}

package/dist/middleware/rate-limit.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Rate Limiting Middleware
+ *
+ * Sliding-window rate limiter keyed by caller phone number.
+ * Prevents abuse by limiting requests per phone number within a time window.
+ */
+import type { Context, Next } from "hono";
+/**
+ * Check if a phone number has exceeded the rate limit.
+ * Returns true if the request should be allowed.
+ */
+export declare function checkRateLimit(phoneNumber: string, maxRequests: number, windowMs: number): boolean;
+/**
+ * Hono middleware factory for rate limiting.
+ *
+ * Limits requests per phone number (from body.From).
+ * Returns a 429 TwiML response when the limit is exceeded.
+ */
+export declare function rateLimitMiddleware(config?: {
+    maxRequests?: number;
+    windowMs?: number;
+}): (c: Context, next: Next) => Promise<void | (Response & import("hono").TypedResponse<"<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<Response>\n    <Say>Please try again in a moment.</Say>\n</Response>", 429, "text">)>;
+/**
+ * Reset rate limit store (for testing)
+ */
+export declare function resetRateLimitStore(): void;
+//# sourceMappingURL=rate-limit.d.ts.map

package/dist/middleware/rate-limit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../src/middleware/rate-limit.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AA4B1C;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,GACf,OAAO,CAmBT;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,IAMxE,GAAG,OAAO,EAAE,MAAM,IAAI,iMAerC;AAED;;GAEG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CAM1C"}

package/dist/middleware/rate-limit.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=rate-limit.test.d.ts.map

package/dist/middleware/rate-limit.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.test.d.ts","sourceRoot":"","sources":["../../src/middleware/rate-limit.test.ts"],"names":[],"mappings":""}

package/dist/middleware/twilio-signature.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Twilio Webhook Signature Validation Middleware
+ *
+ * Validates that incoming requests are genuinely from Twilio by verifying
+ * the X-Twilio-Signature header using HMAC-SHA1 per Twilio's spec.
+ *
+ * @see https://www.twilio.com/docs/usage/security#validating-requests
+ */
+import type { Context, Next } from "hono";
+/**
+ * Compute the expected Twilio signature for a request.
+ *
+ * Algorithm (per Twilio docs):
+ * 1. Take the full URL of the request
+ * 2. Sort POST body params alphabetically by key
+ * 3. Append each key-value pair to the URL (no separators)
+ * 4. HMAC-SHA1 the result with the auth token, then Base64 encode
+ */
+export declare function computeTwilioSignature(authToken: string, url: string, params: Record<string, string>): string;
+/**
+ * Validate a Twilio request signature
+ */
+export declare function validateTwilioSignature(authToken: string, signature: string, url: string, params: Record<string, string>): boolean;
+/**
+ * Hono middleware factory for Twilio signature validation.
+ *
+ * When authToken is provided, rejects any request without a valid
+ * X-Twilio-Signature header. When authToken is not configured,
+ * the middleware is a pass-through (allows development/testing without Twilio).
+ */
+export declare function twilioSignatureMiddleware(authToken?: string, baseUrl?: string): (c: Context, next: Next) => Promise<void | (Response & import("hono").TypedResponse<"", 403, "text">)>;
+//# sourceMappingURL=twilio-signature.d.ts.map

package/dist/middleware/twilio-signature.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"twilio-signature.d.ts","sourceRoot":"","sources":["../../src/middleware/twilio-signature.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG1C;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC7B,MAAM,CAOR;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC7B,OAAO,CAWT;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,IAC9D,GAAG,OAAO,EAAE,MAAM,IAAI,gFAkCrC"}

package/dist/middleware/twilio-signature.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=twilio-signature.test.d.ts.map

package/dist/middleware/twilio-signature.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"twilio-signature.test.d.ts","sourceRoot":"","sources":["../../src/middleware/twilio-signature.test.ts"],"names":[],"mappings":""}

package/dist/routes/call/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/routes/call/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAOtD;;GAEG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,YAAY,8EAU1E"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/routes/call/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAIzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAOtD;;GAEG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,YAAY,8EAoB1E"}

package/dist/routes/call/processor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"processor.d.ts","sourceRoot":"","sources":["../../../src/routes/call/processor.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAWH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEtD;;GAEG;AACH,wBAAsB,WAAW,CAC/B,IAAI,EAAE,kBAAkB,EACxB,QAAQ,EAAE,YAAY,EACtB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,MAAM,CAAC,CA6DjB"}
+{"version":3,"file":"processor.d.ts","sourceRoot":"","sources":["../../../src/routes/call/processor.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAWH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEtD;;GAEG;AACH,wBAAsB,WAAW,CAC/B,IAAI,EAAE,kBAAkB,EACxB,QAAQ,EAAE,YAAY,EACtB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,MAAM,CAAC,CA8DjB"}

package/dist/routes/sms/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/routes/sms/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAGtD;;GAEG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,YAAY,8EAOzE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/routes/sms/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAIzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAGtD;;GAEG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,YAAY,8EAYzE"}

package/dist/types.d.ts

@@ -98,6 +98,15 @@ export interface TalkerConfig {
     cleanupIntervalMs?: number;
     /** Maximum no-speech retries before ending call. Default: 3 */
     maxNoSpeechRetries?: number;
+    /** Rate limiting configuration */
+    rateLimit?: {
+        /** Max requests per window per phone number. Default: 30 */
+        maxRequests?: number;
+        /** Window size in milliseconds. Default: 60000 (1 minute) */
+        windowMs?: number;
+    };
+    /** Maximum input length for speech/SMS messages in characters. Default: 1000 */
+    maxInputLength?: number;
     /** Chat function override. By default, talker queries chatter's RAG pipeline directly */
     chatFn?: (phoneNumber: string, message: string) => Promise<string>;
 }

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAIlE;;GAEG;AACH,MAAM,MAAM,OAAO,GAAG,MAAM,GAAG,KAAK,CAAC;AAErC;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,iDAAiD;IACjD,KAAK,EAAE,MAAM,CAAC;IACd,0CAA0C;IAC1C,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,yBAAyB;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wBAAwB;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2CAA2C;IAC3C,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,wEAAwE;IACxE,GAAG,EAAE,MAAM,CAAC;IACZ,yDAAyD;IACzD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,iEAAiE;IACjE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6CAA6C;IAC7C,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,6CAA6C;IAC7C,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,8EAA8E;IAC9E,6BAA6B,CAAC,EAAE,OAAO,CAAC;CACzC;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,0CAA0C;IAC1C,MAAM,CAAC,EAAE,YAAY,CAAC;IAEtB,wEAAwE;IACxE,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,yFAAyF;IACzF,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAErC,qHAAqH;IACrH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,0EAA0E;IAC1E,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,wCAAwC;IACxC,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAE9B,oBAAoB;IACpB,QAAQ,CAAC,EAAE,qBAAqB,CAAC;IAEjC,uGAAuG;IACvG,OAAO,CAAC,EAAE,aAAa,CAAC;IAExB,uGAAuG;IACvG,QAAQ,CAAC,EAAE;QACT,gCAAgC;QAChC,GAAG,EAAE,MAAM,CAAC;QACZ,uBAAuB;QACvB,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;IAEF,iGAAiG;IACjG,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,mFAAmF;IACnF,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,8EAA8E;IAC9E,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,4EAA4E;IAC5E,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B,+DAA+D;IAC/D,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAE5B,yFAAyF;IACzF,MAAM,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACpE;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,qFAAqF;IACrF,OAAO,EAAE,kBAAkB,CAAC;IAC5B,oCAAoC;IACpC,MAAM,EAAE,YAAY,CAAC;IACrB,0DAA0D;IAC1D,YAAY,EAAE,MAAM,CAAC;IACrB,wDAAwD;IACxD,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,0DAA0D;IAC1D,cAAc,EAAE,OAAO,CAAC;IACxB,uDAAuD;IACvD,aAAa,EAAE,OAAO,CAAC;IACvB,yCAAyC;IACzC,gBAAgB,EAAE,MAAM,CAAC;IACzB,oCAAoC;IACpC,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED;;GAEG;AAEH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC;IACtC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,QAAQ,CAAC;IACf,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAC/C,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,MAAM,EAAE,UAAU,CAAC;CACpB;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,iCAAiC;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,0CAA0C;IAC1C,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,MAAM,WAAW,GAAG,CACxB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,OAAO,EAAE,kBAAkB,KACxB,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAEhC,MAAM,MAAM,WAAW,GAAG,CACxB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC7B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE7B,MAAM,WAAW,oBAAoB;IACnC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzC,eAAe,EAAE,OAAO,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,UAAU;IACzB,UAAU,EAAE,cAAc,CAAC;IAC3B,OAAO,EAAE,WAAW,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,EAAE,WAAW,CAAC;CACvB;AAED,MAAM,WAAW,UAAU;IACzB,YAAY,EAAE,OAAO,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,OAAO,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,cAAc,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,GAAG,WAAW,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC1F,UAAU,EAAE,SAAS,GAAG,IAAI,CAAC;IAC7B,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,OAAO;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE;QACR,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE;QACJ,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,GAAG,EAAE;QACH,QAAQ,EAAE,MAAM,CAAC;QACjB,aAAa,EAAE,MAAM,CAAC;QACtB,WAAW,EAAE,MAAM,CAAC;QACpB,eAAe,EAAE,MAAM,CAAC;QACxB,YAAY,EAAE,MAAM,CAAC;KACtB,CAAC;CACH"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAIlE;;GAEG;AACH,MAAM,MAAM,OAAO,GAAG,MAAM,GAAG,KAAK,CAAC;AAErC;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,iDAAiD;IACjD,KAAK,EAAE,MAAM,CAAC;IACd,0CAA0C;IAC1C,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,yBAAyB;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wBAAwB;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2CAA2C;IAC3C,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,wEAAwE;IACxE,GAAG,EAAE,MAAM,CAAC;IACZ,yDAAyD;IACzD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,iEAAiE;IACjE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6CAA6C;IAC7C,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,6CAA6C;IAC7C,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,8EAA8E;IAC9E,6BAA6B,CAAC,EAAE,OAAO,CAAC;CACzC;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,0CAA0C;IAC1C,MAAM,CAAC,EAAE,YAAY,CAAC;IAEtB,wEAAwE;IACxE,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,yFAAyF;IACzF,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAErC,qHAAqH;IACrH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,0EAA0E;IAC1E,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,wCAAwC;IACxC,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAE9B,oBAAoB;IACpB,QAAQ,CAAC,EAAE,qBAAqB,CAAC;IAEjC,uGAAuG;IACvG,OAAO,CAAC,EAAE,aAAa,CAAC;IAExB,uGAAuG;IACvG,QAAQ,CAAC,EAAE;QACT,gCAAgC;QAChC,GAAG,EAAE,MAAM,CAAC;QACZ,uBAAuB;QACvB,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;IAEF,iGAAiG;IACjG,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,mFAAmF;IACnF,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,8EAA8E;IAC9E,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,4EAA4E;IAC5E,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B,+DAA+D;IAC/D,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAE5B,kCAAkC;IAClC,SAAS,CAAC,EAAE;QACV,4DAA4D;QAC5D,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,6DAA6D;QAC7D,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IAEF,gFAAgF;IAChF,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,yFAAyF;IACzF,MAAM,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACpE;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,qFAAqF;IACrF,OAAO,EAAE,kBAAkB,CAAC;IAC5B,oCAAoC;IACpC,MAAM,EAAE,YAAY,CAAC;IACrB,0DAA0D;IAC1D,YAAY,EAAE,MAAM,CAAC;IACrB,wDAAwD;IACxD,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,0DAA0D;IAC1D,cAAc,EAAE,OAAO,CAAC;IACxB,uDAAuD;IACvD,aAAa,EAAE,OAAO,CAAC;IACvB,yCAAyC;IACzC,gBAAgB,EAAE,MAAM,CAAC;IACzB,oCAAoC;IACpC,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED;;GAEG;AAEH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC;IACtC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,QAAQ,CAAC;IACf,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAC/C,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,MAAM,EAAE,UAAU,CAAC;CACpB;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,iCAAiC;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,0CAA0C;IAC1C,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,MAAM,WAAW,GAAG,CACxB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,OAAO,EAAE,kBAAkB,KACxB,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAEhC,MAAM,MAAM,WAAW,GAAG,CACxB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC7B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE7B,MAAM,WAAW,oBAAoB;IACnC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzC,eAAe,EAAE,OAAO,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,UAAU;IACzB,UAAU,EAAE,cAAc,CAAC;IAC3B,OAAO,EAAE,WAAW,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,EAAE,WAAW,CAAC;CACvB;AAED,MAAM,WAAW,UAAU;IACzB,YAAY,EAAE,OAAO,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,OAAO,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,cAAc,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,GAAG,WAAW,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC1F,UAAU,EAAE,SAAS,GAAG,IAAI,CAAC;IAC7B,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,OAAO;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE;QACR,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE;QACJ,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,GAAG,EAAE;QACH,QAAQ,EAAE,MAAM,CAAC;QACjB,aAAa,EAAE,MAAM,CAAC;QACtB,WAAW,EAAE,MAAM,CAAC;QACpB,eAAe,EAAE,MAAM,CAAC;QACxB,YAAY,EAAE,MAAM,CAAC;KACtB,CAAC;CACH"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@diegoaltoworks/talker",
-  "version": "0.8.0",
+  "version": "0.10.0",
   "description": "Telephony plugin for Chatter — adds voice call and SMS support via Twilio",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",
@@ -85,8 +85,8 @@
   },
   "devDependencies": {
     "@biomejs/biome": "^1.9.4",
-    "@diegoaltoworks/chatter": "^0.1.8",
-    "@libsql/client": "^0.14.0",
+    "@diegoaltoworks/chatter": "^0.10.0",
+    "@libsql/client": "^0.17.0",
     "@types/bun": "^1.1.12",
     "@types/node": "^22.9.1",
     "esbuild": "^0.27.4",