@fonoster/common 0.27.0 → 0.30.0

package/dist/constants.d.ts

@@ -19,13 +19,10 @@
 import { ServingStatus } from "grpc-health-check";
 export declare const GRPC_NOT_SERVING_STATUS: ServingStatus;
 export declare const GRPC_SERVING_STATUS: ServingStatus;
-export declare const STASIS_APP_NAME = "mediacontroller";
-export declare const CALL_CONTEXT = "local-ctx-common";
-export declare const CALL_EXTENSION = "start";
 export declare const CALL_DETAIL_RECORD_MEASUREMENT = "cdr";
 export declare const INFLUXDB_CALLS_BUCKET = "calls";
 export declare const APP_REF_HEADER = "x-app-ref";
-export declare const ROUTR_DEFAULT_PEER_AOR = "sip:voice@default";
+export declare const ROUTR_DEFAULT_PEER_AOR = "sip:medianode@default";
 export declare const AUTOPILOT_SPECIAL_LOCAL_ADDRESS = "autopilot.fonoster.local";
 export declare const AUTOPILOT_INTERNAL_ADDRESS = "autopilot:50061";
 export declare const WELCOME_DEMO_SPECIAL_LOCAL_ADDRESS = "welcome.demo.fonoster.local";

package/dist/constants.js

@@ -1,15 +1,14 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.WELCOME_DEMO_SPECIAL_LOCAL_ADDRESS = exports.AUTOPILOT_INTERNAL_ADDRESS = exports.AUTOPILOT_SPECIAL_LOCAL_ADDRESS = exports.ROUTR_DEFAULT_PEER_AOR = exports.APP_REF_HEADER = exports.INFLUXDB_CALLS_BUCKET = exports.CALL_DETAIL_RECORD_MEASUREMENT = exports.CALL_EXTENSION = exports.CALL_CONTEXT = exports.STASIS_APP_NAME = exports.GRPC_SERVING_STATUS = exports.GRPC_NOT_SERVING_STATUS = void 0;
+exports.WELCOME_DEMO_SPECIAL_LOCAL_ADDRESS = exports.AUTOPILOT_INTERNAL_ADDRESS = exports.AUTOPILOT_SPECIAL_LOCAL_ADDRESS = exports.ROUTR_DEFAULT_PEER_AOR = exports.APP_REF_HEADER = exports.INFLUXDB_CALLS_BUCKET = exports.CALL_DETAIL_RECORD_MEASUREMENT = exports.GRPC_SERVING_STATUS = exports.GRPC_NOT_SERVING_STATUS = void 0;
 exports.GRPC_NOT_SERVING_STATUS = "NOT_SERVING";
 exports.GRPC_SERVING_STATUS = "SERVING";
-exports.STASIS_APP_NAME = "mediacontroller";
-exports.CALL_CONTEXT = "local-ctx-common";
-exports.CALL_EXTENSION = "start";
 exports.CALL_DETAIL_RECORD_MEASUREMENT = "cdr";
 exports.INFLUXDB_CALLS_BUCKET = "calls";
 exports.APP_REF_HEADER = "x-app-ref";
-exports.ROUTR_DEFAULT_PEER_AOR = "sip:voice@default";
+// The peer app-linked numbers point at: the Go media nodes (least-sessions). Asterisk's
+// sip:voice@default is gone (cleanbreak CB-B3).
+exports.ROUTR_DEFAULT_PEER_AOR = "sip:medianode@default";
 exports.AUTOPILOT_SPECIAL_LOCAL_ADDRESS = "autopilot.fonoster.local";
 exports.AUTOPILOT_INTERNAL_ADDRESS = "autopilot:50061";
 exports.WELCOME_DEMO_SPECIAL_LOCAL_ADDRESS = "welcome.demo.fonoster.local";

package/dist/envs.d.ts

@@ -1 +1,2 @@
-export declare const ROOT_DOMAIN: string;
+export declare const setRootDomain: (domain: string) => void;
+export declare const getRootDomain: () => string;

package/dist/envs.js

@@ -1,9 +1,6 @@
 "use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ROOT_DOMAIN = void 0;
+exports.getRootDomain = exports.setRootDomain = void 0;
 /**
  * Copyright (C) 2025 by Fonoster Inc (https://fonoster.com)
  * http://github.com/fonoster/fonoster
@@ -22,10 +19,15 @@ exports.ROOT_DOMAIN = void 0;
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-const path_1 = require("path");
-const dotenv_1 = __importDefault(require("dotenv"));
-if (process.env.NODE_ENV === "development") {
-    dotenv_1.default.config({ path: (0, path_1.join)(__dirname, "..", "..", "..", ".env") });
-}
-const e = process.env;
-exports.ROOT_DOMAIN = e.APISERVER_ROOT_DOMAIN || e.ROOT_DOMAIN || "fonoster.local";
+/**
+ * Root SIP domain that workspace domains must end with. The API server sets it
+ * from fonoster.yaml's `domain` at boot (setRootDomain); nothing reads it from
+ * the environment or a .env file (fix-config-and-placement-gaps).
+ */
+let rootDomain = "fonoster.local";
+const setRootDomain = (domain) => {
+    rootDomain = domain;
+};
+exports.setRootDomain = setRootDomain;
+const getRootDomain = () => rootDomain;
+exports.getRootDomain = getRootDomain;

package/dist/identity/createAuthInterceptor.d.ts

@@ -1,15 +1,22 @@
 import { ServerInterceptingCall } from "@grpc/grpc-js";
+import { TokenVerifyOptions } from "./isValidToken";
 /**
  * This function is a gRPC interceptor that checks if the request is valid
  * and if the user has the right permissions to access the resource. When
  * validating the request, the function will check if the request is in the
- * skip list, if the token is valid and if the role is allowed by the RBAC.
+ * skip list, if the token is a valid access token (RS256, unexpired,
+ * `tokenUse: "access"`, and the pinned issuer and audience when given) and if
+ * the caller's role in the target workspace is allowed by the RBAC.
+ *
+ * It fails closed: any error while checking a request answers
+ * UNAUTHENTICATED instead of reaching the handler or throwing.
  *
  * @param {string} identityPublicKey - The public key to validate the token
  * @param {string[]} publicPath - The list of public paths
+ * @param {TokenVerifyOptions} options - Issuer and audience to pin
  * @return {Function} - The gRPC interceptor
  */
-declare function createAuthInterceptor(identityPublicKey: string, publicPath: string[]): (methodDefinition: {
+declare function createAuthInterceptor(identityPublicKey: string, publicPath: string[], options?: TokenVerifyOptions): (methodDefinition: {
     path: string;
 }, call: ServerInterceptingCall) => ServerInterceptingCall;
 export { createAuthInterceptor };

package/dist/identity/createAuthInterceptor.js

@@ -20,26 +20,29 @@ exports.createAuthInterceptor = createAuthInterceptor;
  * limitations under the License.
  */
 const logger_1 = require("@fonoster/logger");
-const decodeToken_1 = require("./decodeToken");
 const errors_1 = require("./errors");
 const getAccessKeyIdFromCall_1 = require("./getAccessKeyIdFromCall");
 const getTokenFromCall_1 = require("./getTokenFromCall");
 const hasAccess_1 = require("./hasAccess");
-const isValidToken_1 = require("./isValidToken");
-const roles_1 = require("./roles");
-const tokenHasAccessKeyId_1 = require("./tokenHasAccessKeyId");
+const verifyAccessToken_1 = require("./verifyAccessToken");
 const logger = (0, logger_1.getLogger)({ service: "common", filePath: __filename });
 /**
  * This function is a gRPC interceptor that checks if the request is valid
  * and if the user has the right permissions to access the resource. When
  * validating the request, the function will check if the request is in the
- * skip list, if the token is valid and if the role is allowed by the RBAC.
+ * skip list, if the token is a valid access token (RS256, unexpired,
+ * `tokenUse: "access"`, and the pinned issuer and audience when given) and if
+ * the caller's role in the target workspace is allowed by the RBAC.
+ *
+ * It fails closed: any error while checking a request answers
+ * UNAUTHENTICATED instead of reaching the handler or throwing.
  *
  * @param {string} identityPublicKey - The public key to validate the token
  * @param {string[]} publicPath - The list of public paths
+ * @param {TokenVerifyOptions} options - Issuer and audience to pin
  * @return {Function} - The gRPC interceptor
  */
-function createAuthInterceptor(identityPublicKey, publicPath) {
+function createAuthInterceptor(identityPublicKey, publicPath, options = {}) {
     /**
      * Inner function that will be called by the gRPC server.
      *
@@ -49,33 +52,36 @@ function createAuthInterceptor(identityPublicKey, publicPath) {
      * @return {ServerInterceptingCall} - The modified call object
      */
     return (methodDefinition, call) => {
-        const { path } = methodDefinition;
-        const accessKeyId = (0, getAccessKeyIdFromCall_1.getAccessKeyIdFromCall)(call);
-        logger.verbose("intercepting api call to path", { accessKeyId, path });
-        if (publicPath.includes(methodDefinition.path)) {
-            logger.verbose("passing auth control to edge function", { path });
+        try {
+            const { path } = methodDefinition;
+            const accessKeyId = (0, getAccessKeyIdFromCall_1.getAccessKeyIdFromCall)(call);
+            logger.verbose("intercepting api call to path", { accessKeyId, path });
+            if (publicPath.includes(path)) {
+                logger.verbose("passing auth control to edge function", { path });
+                return call;
+            }
+            logger.verbose("validating token", { accessKeyId, path });
+            const decodedToken = (0, verifyAccessToken_1.verifyAccessToken)((0, getTokenFromCall_1.getTokenFromCall)(call), identityPublicKey, options);
+            if (!decodedToken) {
+                return (0, errors_1.unauthenticatedError)(call);
+            }
+            const allowed = (0, hasAccess_1.hasAccess)(decodedToken, path, accessKeyId);
+            logger.verbose("checking access for accessKeyId", {
+                accessKeyId,
+                path,
+                hasAccess: allowed
+            });
+            if (!allowed) {
+                return (0, errors_1.permissionDeniedError)(call);
+            }
             return call;
         }
-        const token = (0, getTokenFromCall_1.getTokenFromCall)(call);
-        logger.verbose("validating token", { accessKeyId, path });
-        if (!(0, isValidToken_1.isValidToken)(token, identityPublicKey)) {
+        catch (error) {
+            logger.warn("refusing a call that failed the auth check", {
+                path: methodDefinition === null || methodDefinition === void 0 ? void 0 : methodDefinition.path,
+                error: error === null || error === void 0 ? void 0 : error.message
+            });
             return (0, errors_1.unauthenticatedError)(call);
         }
-        const decodedToken = (0, decodeToken_1.decodeToken)(token);
-        logger.verbose("checking access for accessKeyId", {
-            accessKeyId,
-            path,
-            hasAccess: (0, hasAccess_1.hasAccess)(decodedToken, path),
-            pathIsWorkspacePath: roles_1.workspaceResourceAccess.includes(path),
-            tokenHasAccessKeyId: (0, tokenHasAccessKeyId_1.tokenHasAccessKeyId)(token, accessKeyId)
-        });
-        if (!(0, hasAccess_1.hasAccess)(decodedToken, path) ||
-            (roles_1.workspaceResourceAccess.includes(path) &&
-                !(0, tokenHasAccessKeyId_1.tokenHasAccessKeyId)(token, accessKeyId)) ||
-            (roles_1.workspaceResourceOwnerOrAdminAccess.includes(path) &&
-                !(0, tokenHasAccessKeyId_1.tokenHasAccessKeyId)(token, accessKeyId))) {
-            return (0, errors_1.permissionDeniedError)(call);
-        }
-        return call;
     };
 }

package/dist/identity/hasAccess.d.ts

@@ -1,6 +1,12 @@
 import { Access } from "./types";
+/**
+ * Whether the token's roles allow the gRPC method. For a workspace method only
+ * the caller's role in the target workspace (`targetAccessKeyId`) counts, never
+ * a role held in another workspace; without a matching entry it is refused.
+ * Malformed claims are refused rather than thrown on.
+ */
 declare function hasAccess(decodedToken: {
-    access: Access[];
-    accessKeyId: string;
-}, method: string): boolean;
+    access?: Access[];
+    accessKeyId?: string;
+}, method: string, targetAccessKeyId?: string): boolean;
 export { hasAccess };

package/dist/identity/hasAccess.js

@@ -21,12 +21,36 @@ exports.hasAccess = hasAccess;
  */
 const types_1 = require("@fonoster/types");
 const roles_1 = require("./roles");
-// This function only checks if the role has access to the grpc method
-function hasAccess(decodedToken, method) {
-    const { access, accessKeyId } = decodedToken;
-    const roleList = accessKeyId.startsWith("US") && // US is for user; user tokens only have USER role
-        access.length === 0 // If it is a user token, and has no access, we still allow it in case it is a user method
-        ? [types_1.Role.USER]
-        : access.map((a) => a.role);
-    return roleList.some((r) => roles_1.roles.find((role) => role.name === r && role.access.includes(method)));
+/** Methods that act inside one workspace, named by the request's accessKeyId. */
+const isWorkspaceMethod = (method) => roles_1.workspaceResourceAccess.includes(method) ||
+    roles_1.workspaceResourceOwnerOrAdminAccess.includes(method);
+const roleAllows = (roleName, method) => roles_1.roles.some((role) => role.name === roleName && role.access.includes(method));
+/**
+ * Whether the token's roles allow the gRPC method. For a workspace method only
+ * the caller's role in the target workspace (`targetAccessKeyId`) counts, never
+ * a role held in another workspace; without a matching entry it is refused.
+ * Malformed claims are refused rather than thrown on.
+ */
+function hasAccess(decodedToken, method, targetAccessKeyId) {
+    const access = Array.isArray(decodedToken === null || decodedToken === void 0 ? void 0 : decodedToken.access)
+        ? decodedToken.access.filter((a) => a && typeof a.role === "string" && typeof a.accessKeyId === "string")
+        : [];
+    const accessKeyId = typeof (decodedToken === null || decodedToken === void 0 ? void 0 : decodedToken.accessKeyId) === "string"
+        ? decodedToken.accessKeyId
+        : "";
+    if (isWorkspaceMethod(method)) {
+        if (!targetAccessKeyId) {
+            return false;
+        }
+        const entry = access.find((a) => a.accessKeyId === targetAccessKeyId);
+        return entry ? roleAllows(entry.role, method) : false;
+    }
+    // User tokens (accessKeyId "US…") always carry the USER role, so methods
+    // about the user themselves (e.g. UpdateUser, CreateWorkspace) keep working
+    // once they belong to a workspace. Their workspace roles add to it.
+    const workspaceRoles = access.map((a) => a.role);
+    const roleList = accessKeyId.startsWith("US")
+        ? [types_1.Role.USER, ...workspaceRoles]
+        : workspaceRoles;
+    return roleList.some((r) => roleAllows(r, method));
 }

package/dist/identity/index.d.ts

@@ -23,5 +23,6 @@ export * from "./getAccessKeyIdFromCall";
 export * from "./getTokenFromCall";
 export * from "./hasAccess";
 export * from "./isValidToken";
+export * from "./verifyAccessToken";
 export * from "./types";
 export * from "./roles";

package/dist/identity/index.js

@@ -39,5 +39,6 @@ __exportStar(require("./getAccessKeyIdFromCall"), exports);
 __exportStar(require("./getTokenFromCall"), exports);
 __exportStar(require("./hasAccess"), exports);
 __exportStar(require("./isValidToken"), exports);
+__exportStar(require("./verifyAccessToken"), exports);
 __exportStar(require("./types"), exports);
 __exportStar(require("./roles"), exports);

package/dist/identity/isValidToken.d.ts

@@ -1,2 +1,12 @@
-declare function isValidToken(token: string, secret: string): boolean;
-export { isValidToken };
+import jwt from "jsonwebtoken";
+/** Identity signs every token with RS256; nothing else is accepted. */
+declare const IDENTITY_SIGN_ALGORITHMS: jwt.Algorithm[];
+/** Claims to pin when verifying; each one is checked only when given. */
+type TokenVerifyOptions = {
+    issuer?: string;
+    audience?: string;
+};
+/** The verified claims, or undefined when the signature, expiry or claims don't check out. */
+declare function verifyToken(token: string, secret: string, options?: TokenVerifyOptions): Record<string, unknown> | undefined;
+declare function isValidToken(token: string, secret: string, options?: TokenVerifyOptions): boolean;
+export { IDENTITY_SIGN_ALGORITHMS, isValidToken, TokenVerifyOptions, verifyToken };

package/dist/identity/isValidToken.js

@@ -3,7 +3,9 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.IDENTITY_SIGN_ALGORITHMS = void 0;
 exports.isValidToken = isValidToken;
+exports.verifyToken = verifyToken;
 /**
  * Copyright (C) 2025 by Fonoster Inc (https://fonoster.com)
  * http://github.com/fonoster/fonoster
@@ -26,26 +28,40 @@ const logger_1 = require("@fonoster/logger");
 const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
 const types_1 = require("./types");
 const logger = (0, logger_1.getLogger)({ service: "identity", filePath: __filename });
-function isValidToken(token, secret) {
+/** Identity signs every token with RS256; nothing else is accepted. */
+const IDENTITY_SIGN_ALGORITHMS = ["RS256"];
+exports.IDENTITY_SIGN_ALGORITHMS = IDENTITY_SIGN_ALGORITHMS;
+/** The verified claims, or undefined when the signature, expiry or claims don't check out. */
+function verifyToken(token, secret, options = {}) {
+    if (!token || typeof token !== "string") {
+        return undefined;
+    }
     try {
-        const decoded = jsonwebtoken_1.default.verify(token, secret);
+        const decoded = jsonwebtoken_1.default.verify(token, secret, Object.assign(Object.assign({ algorithms: IDENTITY_SIGN_ALGORITHMS }, (options.issuer ? { issuer: options.issuer } : {})), (options.audience ? { audience: options.audience } : {})));
+        if (!decoded || typeof decoded !== "object") {
+            return undefined;
+        }
+        const { exp } = decoded;
         const currentTime = Math.floor(Date.now() / 1000);
-        if (decoded.exp <= currentTime) {
-            logger.verbose("token expired", { exp: decoded.exp, currentTime });
-            return false;
+        if (typeof exp !== "number" || exp <= currentTime) {
+            logger.verbose("token expired or without expiry", { exp, currentTime });
+            return undefined;
         }
-        return true;
+        return decoded;
     }
     catch (error) {
         if (error.name === types_1.JsonWebErrorEnum.JsonWebTokenError) {
-            logger.verbose("invalid JWT token", { token });
+            logger.verbose("invalid JWT token");
         }
         else if (error.name === types_1.JsonWebErrorEnum.TokenExpiredError) {
-            logger.verbose("token expired", { token });
+            logger.verbose("token expired");
         }
         else {
             logger.verbose("unexpected JWT error:", error);
         }
-        return false;
+        return undefined;
     }
 }
+function isValidToken(token, secret, options = {}) {
+    return verifyToken(token, secret, options) !== undefined;
+}

package/dist/identity/roles.js

@@ -30,6 +30,18 @@ const workspaceResourceAccess = [
     "/fonoster.applications.v1beta2.Applications/DeleteApplication",
     "/fonoster.applications.v1beta2.Applications/ListApplications",
     "/fonoster.applications.v1beta2.Applications/EvaluateIntelligence",
+    "/fonoster.applications.v1beta2.Applications/RotateSigningSecret",
+    "/fonoster.webhooks.v1beta2.Webhooks/CreateWebhook",
+    "/fonoster.webhooks.v1beta2.Webhooks/ListWebhooks",
+    "/fonoster.webhooks.v1beta2.Webhooks/GetWebhook",
+    "/fonoster.webhooks.v1beta2.Webhooks/UpdateWebhook",
+    "/fonoster.webhooks.v1beta2.Webhooks/DeleteWebhook",
+    "/fonoster.webhooks.v1beta2.Webhooks/RotateWebhookSecret",
+    "/fonoster.webhooks.v1beta2.Webhooks/ListWebhookDeliveries",
+    "/fonoster.webhooks.v1beta2.Webhooks/ResendWebhookDelivery",
+    "/fonoster.providers.v1beta2.Providers/ListCatalog",
+    "/fonoster.providers.v1beta2.Providers/ListProviderKeys",
+    "/fonoster.providers.v1beta2.Providers/ListWarnings",
     "/fonoster.agents.v1beta2.Agents/CreateAgent",
     "/fonoster.agents.v1beta2.Agents/UpdateAgent",
     "/fonoster.agents.v1beta2.Agents/GetAgent",
@@ -69,18 +81,22 @@ const workspaceResourceAccess = [
     "/fonoster.calls.v1beta2.Calls/ListCalls",
     "/fonoster.calls.v1beta2.Calls/GetCall",
     "/fonoster.calls.v1beta2.Calls/TrackCall",
-    "/fonoster.voice.v1beta2.Voice/CreateSession",
-    "/fonoster.identity.v1beta2.Identity/CreateApiKey",
-    "/fonoster.identity.v1beta2.Identity/DeleteApiKey",
-    "/fonoster.identity.v1beta2.Identity/ListApiKeys",
-    "/fonoster.identity.v1beta2.Identity/RegenerateApiKey"
+    "/fonoster.voice.v1beta2.Voice/CreateSession"
 ];
 exports.workspaceResourceAccess = workspaceResourceAccess;
 const workspaceResourceOwnerOrAdminAccess = [
+    // Bring-your-own vendor keys (add-provider-registry P1): owners and admins only.
+    "/fonoster.providers.v1beta2.Providers/SetProviderKey",
+    "/fonoster.providers.v1beta2.Providers/DeleteProviderKey",
     "/fonoster.identity.v1beta2.Identity/ListWorkspaceMembers",
     "/fonoster.identity.v1beta2.Identity/InviteUserToWorkspace",
     "/fonoster.identity.v1beta2.Identity/RemoveUserFromWorkspace",
-    "/fonoster.identity.v1beta2.Identity/ResendWorkspaceMembershipInvitation"
+    "/fonoster.identity.v1beta2.Identity/ResendWorkspaceMembershipInvitation",
+    // API keys act with WORKSPACE_ADMIN rights, so only owners and admins manage them.
+    "/fonoster.identity.v1beta2.Identity/CreateApiKey",
+    "/fonoster.identity.v1beta2.Identity/DeleteApiKey",
+    "/fonoster.identity.v1beta2.Identity/ListApiKeys",
+    "/fonoster.identity.v1beta2.Identity/RegenerateApiKey"
 ];
 exports.workspaceResourceOwnerOrAdminAccess = workspaceResourceOwnerOrAdminAccess;
 const fullIdentityAccess = [

package/dist/identity/types.d.ts

@@ -20,7 +20,8 @@ import { Role } from "@fonoster/types";
 declare enum TokenUseEnum {
     ID = "id",
     ACCESS = "access",
-    REFRESH = "refresh"
+    REFRESH = "refresh",
+    INVITE = "invite"
 }
 declare enum JsonWebErrorEnum {
     JsonWebTokenError = "JsonWebTokenError",
@@ -49,6 +50,8 @@ type IdToken = BaseToken & {
     phoneNumberVerified: boolean;
     phoneNumber: string;
     email: string;
+    /** True while the user holds an invite's one-time password. */
+    mustChangePassword?: boolean;
     tokenUse: TokenUseEnum.ID;
 };
 type AccessToken = BaseToken & {
@@ -57,6 +60,8 @@ type AccessToken = BaseToken & {
 };
 type RefreshToken = BaseToken & {
     tokenUse: TokenUseEnum.REFRESH;
+    /** Unique id, tracked by Identity for rotation and revocation. */
+    jti?: string;
 };
 type DecodedToken<T extends TokenUseEnum> = T extends TokenUseEnum.ID ? IdToken : T extends TokenUseEnum.ACCESS ? AccessToken : T extends TokenUseEnum.REFRESH ? TokenUseEnum : never;
 export { Access, AccessToken, DecodedToken, IdToken, RefreshToken, RoleType, TokenUseEnum, JsonWebErrorEnum };

package/dist/identity/types.js

@@ -6,6 +6,7 @@ var TokenUseEnum;
     TokenUseEnum["ID"] = "id";
     TokenUseEnum["ACCESS"] = "access";
     TokenUseEnum["REFRESH"] = "refresh";
+    TokenUseEnum["INVITE"] = "invite";
 })(TokenUseEnum || (exports.TokenUseEnum = TokenUseEnum = {}));
 var JsonWebErrorEnum;
 (function (JsonWebErrorEnum) {

package/dist/{assistants/LanguageModelProvider.js → identity/verifyAccessToken.d.ts}

@@ -1,6 +1,3 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.LanguageModelProvider = void 0;
 /**
  * Copyright (C) 2025 by Fonoster Inc (https://fonoster.com)
  * http://github.com/fonoster/fonoster
@@ -19,11 +16,13 @@ exports.LanguageModelProvider = void 0;
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-var LanguageModelProvider;
-(function (LanguageModelProvider) {
-    LanguageModelProvider["OPENAI"] = "openai";
-    LanguageModelProvider["GROQ"] = "groq";
-    LanguageModelProvider["OLLAMA"] = "ollama";
-    LanguageModelProvider["GOOGLE"] = "google";
-    LanguageModelProvider["ANTHROPIC"] = "anthropic";
-})(LanguageModelProvider || (exports.LanguageModelProvider = LanguageModelProvider = {}));
+import { TokenVerifyOptions } from "./isValidToken";
+import { AccessToken } from "./types";
+/**
+ * Verifies `token` and returns it only when it is an access token: signed by
+ * Identity (RS256), unexpired, `tokenUse: "access"`, with a string
+ * `accessKeyId` and a well-formed `access` array. Id, refresh, invite and other
+ * signed tokens are refused (undefined), as is anything malformed.
+ */
+declare function verifyAccessToken(token: string, identityPublicKey: string, options?: TokenVerifyOptions): AccessToken | undefined;
+export { verifyAccessToken };

package/dist/identity/verifyAccessToken.js

@@ -0,0 +1,44 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyAccessToken = verifyAccessToken;
+/**
+ * Copyright (C) 2025 by Fonoster Inc (https://fonoster.com)
+ * http://github.com/fonoster/fonoster
+ *
+ * This file is part of Fonoster
+ *
+ * Licensed under the MIT License (the "License");
+ * you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ *    https://opensource.org/licenses/MIT
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+const isValidToken_1 = require("./isValidToken");
+const types_1 = require("./types");
+const isAccessEntry = (entry) => typeof entry === "object" &&
+    entry !== null &&
+    typeof entry.accessKeyId === "string" &&
+    typeof entry.role === "string";
+/**
+ * Verifies `token` and returns it only when it is an access token: signed by
+ * Identity (RS256), unexpired, `tokenUse: "access"`, with a string
+ * `accessKeyId` and a well-formed `access` array. Id, refresh, invite and other
+ * signed tokens are refused (undefined), as is anything malformed.
+ */
+function verifyAccessToken(token, identityPublicKey, options = {}) {
+    const claims = (0, isValidToken_1.verifyToken)(token, identityPublicKey, options);
+    if (!claims ||
+        claims.tokenUse !== types_1.TokenUseEnum.ACCESS ||
+        typeof claims.accessKeyId !== "string" ||
+        !Array.isArray(claims.access) ||
+        !claims.access.every(isAccessEntry)) {
+        return undefined;
+    }
+    return claims;
+}

package/dist/index.d.ts

@@ -17,6 +17,7 @@
  * limitations under the License.
  */
 export * from "./assistants";
+export * from "./config";
 export * from "./GrpcError";
 export * from "./constants";
 export * from "./errors";
@@ -29,6 +30,15 @@ export * from "./types";
 export * from "./utils";
 export * as Validators from "./validators";
 export * from "./validators";
-export * from "./voice";
+export * from "./calls";
 export * from "./countryIsoCodes";
 export * from "./identity";
+export { getRootDomain, setRootDomain } from "./envs";
+export * from "./session";
+export * as Registry from "./registry";
+export * as Webhooks from "./webhooks";
+export * as CellSecrets from "./cellsecrets";
+export * from "./telemetry";
+export * from "./net";
+export * as Sessions from "./sessions";
+export * as RegionHub from "./regions/hub";

package/dist/index.js

@@ -36,7 +36,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.Validators = exports.Messages = void 0;
+exports.RegionHub = exports.Sessions = exports.CellSecrets = exports.Webhooks = exports.Registry = exports.setRootDomain = exports.getRootDomain = exports.Validators = exports.Messages = void 0;
 /**
  * Copyright (C) 2025 by Fonoster Inc (https://fonoster.com)
  * http://github.com/fonoster/fonoster
@@ -56,6 +56,7 @@ exports.Validators = exports.Messages = void 0;
  * limitations under the License.
  */
 __exportStar(require("./assistants"), exports);
+__exportStar(require("./config"), exports);
 __exportStar(require("./GrpcError"), exports);
 __exportStar(require("./constants"), exports);
 __exportStar(require("./errors"), exports);
@@ -68,6 +69,17 @@ __exportStar(require("./types"), exports);
 __exportStar(require("./utils"), exports);
 exports.Validators = __importStar(require("./validators"));
 __exportStar(require("./validators"), exports);
-__exportStar(require("./voice"), exports);
+__exportStar(require("./calls"), exports);
 __exportStar(require("./countryIsoCodes"), exports);
 __exportStar(require("./identity"), exports);
+var envs_1 = require("./envs");
+Object.defineProperty(exports, "getRootDomain", { enumerable: true, get: function () { return envs_1.getRootDomain; } });
+Object.defineProperty(exports, "setRootDomain", { enumerable: true, get: function () { return envs_1.setRootDomain; } });
+__exportStar(require("./session"), exports);
+exports.Registry = __importStar(require("./registry"));
+exports.Webhooks = __importStar(require("./webhooks"));
+exports.CellSecrets = __importStar(require("./cellsecrets"));
+__exportStar(require("./telemetry"), exports);
+__exportStar(require("./net"), exports);
+exports.Sessions = __importStar(require("./sessions"));
+exports.RegionHub = __importStar(require("./regions/hub"));

package/dist/net/assertPublicDestination.d.ts

@@ -0,0 +1,52 @@
+import net from "node:net";
+import { URL } from "node:url";
+/**
+ * Outbound requests to tenant-chosen URLs (Autopilot HTTP tools, webhooks) must not reach the
+ * platform's own network (SSRF, RV-B2): http/https only, and every address the host resolves to
+ * must be public. Operators who self-host can allow internal destinations with
+ * `FONOSTER_ALLOWED_DESTINATIONS` (comma-separated host names, IPs or CIDRs; default empty).
+ */
+export declare class UnsafeDestinationError extends Error {
+    constructor(message: string);
+}
+export type DestinationPolicy = {
+    /** Host names, IPs or CIDRs allowed although private; defaults to FONOSTER_ALLOWED_DESTINATIONS. */
+    allow?: string[];
+};
+/** True when the address is loopback, private, link-local, ULA, CGNAT, multicast or reserved. */
+export declare function isPrivateAddress(ip: string): boolean;
+/**
+ * Checks a tenant-chosen URL: http/https, not an internal name, and every resolved address
+ * public (or allowed by the operator). Returns the parsed URL.
+ */
+export declare function assertPublicDestination(input: string | URL, policy?: DestinationPolicy): Promise<URL>;
+/** Synchronous shape check (scheme, literal IPs, internal names) for request validation. */
+export declare function assertPublicUrlShape(input: string | URL, policy?: DestinationPolicy): URL;
+/**
+ * For WebSocket connections to tenant-chosen URLs (session apps, listeners): checks the URL's
+ * shape (ws/wss, no internal names or private literal IPs) and returns a socket `lookup` that
+ * refuses private addresses when the name resolves. Pass it as the `lookup` option of `ws`.
+ */
+export declare function publicWebSocketGuard(input: string | URL, policy?: DestinationPolicy): {
+    lookup: net.LookupFunction;
+};
+/** Synchronous shape check of a ws:// or wss:// URL (see assertPublicUrlShape). */
+export declare function assertPublicWebSocketUrlShape(input: string | URL, policy?: DestinationPolicy): URL;
+export type SafeFetchInit = {
+    method?: string;
+    headers?: Record<string, string>;
+    body?: string;
+    signal?: AbortSignal;
+    /** Whole-request timeout (default 10 s). */
+    timeoutMs?: number;
+    /** Redirects followed, each re-checked (default 3). */
+    maxRedirects?: number;
+    /** Largest response body read (default 5 MiB). */
+    maxBytes?: number;
+    policy?: DestinationPolicy;
+};
+/**
+ * fetch for tenant-chosen URLs: checks the destination (and each redirect) with
+ * assertPublicDestination, re-checks the addresses the socket connects to, and times out.
+ */
+export declare function safeFetch(input: string | URL, init?: SafeFetchInit): Promise<Response>;