@fonoster/sipnet 0.27.0 → 0.30.0

package/dist/acls/updateAcl.d.ts

@@ -1,22 +1,3 @@
-/**
- * Copyright (C) 2025 by Fonoster Inc (https://fonoster.com)
- * http://github.com/fonoster/fonoster
- *
- * This file is part of Fonoster
- *
- * Licensed under the MIT License (the "License");
- * you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- *
- *    https://opensource.org/licenses/MIT
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-import { GrpcErrorMessage } from "@fonoster/common";
 import { AclsApi } from "@fonoster/types";
 declare function updateAcl(api: AclsApi): (call: {
     request: unknown;

package/dist/acls/updateAcl.js

@@ -29,15 +29,16 @@ exports.updateAcl = updateAcl;
  * limitations under the License.
  */
 const common_1 = require("@fonoster/common");
+const identity_1 = require("@fonoster/identity");
 const logger_1 = require("@fonoster/logger");
 const logger = (0, logger_1.getLogger)({ service: "sipnet", filePath: __filename });
 function updateAcl(api) {
-    const fn = (call, callback) => __awaiter(this, void 0, void 0, function* () {
+    const fn = (call) => __awaiter(this, void 0, void 0, function* () {
         const { request } = call;
         const accessKeyId = (0, common_1.getAccessKeyIdFromCall)(call);
         logger.verbose("call to updateAcl", Object.assign(Object.assign({}, request), { accessKeyId }));
-        const response = yield api.updateAcl(Object.assign(Object.assign({}, request), { deny: ["0.0.0.0/0"] }));
-        callback(null, response);
+        return yield api.updateAcl(Object.assign(Object.assign({}, request), { deny: ["0.0.0.0/0"] }));
     });
-    return (0, common_1.withErrorHandlingAndValidation)(fn, common_1.Validators.updateAclRequestSchema);
+    // Only the caller's own ACLs can be updated, like every other resource.
+    return (0, common_1.withErrorHandlingAndValidation)((0, identity_1.withAccess)(fn, ((ref) => api.getAcl(ref))), common_1.Validators.updateAclRequestSchema);
 }

package/dist/agents/buildService.js

@@ -23,9 +23,11 @@ exports.buildService = buildService;
  * limitations under the License.
  */
 const sdk_1 = __importDefault(require("@routr/sdk"));
+const checkRefs_1 = require("../resources/checkRefs");
 const operations_1 = require("./operations");
 function buildService(clientOptions) {
     const client = new sdk_1.default.Agents(clientOptions);
+    const checkRefs = (0, checkRefs_1.createCheckRefs)((0, checkRefs_1.createRefLookups)(clientOptions));
     return {
         definition: {
             serviceName: "Agents",
@@ -34,8 +36,8 @@ function buildService(clientOptions) {
             proto: "agents.proto"
         },
         handlers: {
-            createAgent: (0, operations_1.createAgent)(client),
-            updateAgent: (0, operations_1.updateAgent)(client),
+            createAgent: (0, operations_1.createAgent)(client, checkRefs),
+            updateAgent: (0, operations_1.updateAgent)(client, checkRefs),
             getAgent: (0, operations_1.getAgent)(client),
             listAgents: (0, operations_1.listAgents)(client),
             deleteAgent: (0, operations_1.deleteAgent)(client)

package/dist/agents/operations.d.ts

@@ -1,8 +1,9 @@
 import { AgentsApi } from "@fonoster/types";
-declare function createAgent(agents: AgentsApi): (call: {
+import { CheckRefs } from "../resources/checkRefs";
+declare function createAgent(agents: AgentsApi, checkRefs?: CheckRefs): (call: {
     request: unknown;
 }, callback: (error?: import("@fonoster/common").GrpcErrorMessage, response?: unknown) => void) => Promise<void>;
-declare function updateAgent(agents: AgentsApi): (call: {
+declare function updateAgent(agents: AgentsApi, checkRefs?: CheckRefs): (call: {
     request: unknown;
 }, callback: (error?: import("@fonoster/common").GrpcErrorMessage, response?: unknown) => void) => Promise<void>;
 declare function getAgent(agents: AgentsApi): (call: {

package/dist/agents/operations.js

@@ -24,17 +24,18 @@ exports.updateAgent = updateAgent;
  * limitations under the License.
  */
 const common_1 = require("@fonoster/common");
+const checkRefs_1 = require("../resources/checkRefs");
 const createResource_1 = require("../resources/createResource");
 const deleteResource_1 = require("../resources/deleteResource");
 const getResource_1 = require("../resources/getResource");
 const listResources_1 = require("../resources/listResources");
 const updateResource_1 = require("../resources/updateResource");
 const RESOURCE = "Agent";
-function createAgent(agents) {
-    return (0, createResource_1.createResource)(agents, RESOURCE, common_1.Validators.createAgentRequestSchema);
+function createAgent(agents, checkRefs) {
+    return (0, createResource_1.createResource)(agents, RESOURCE, common_1.Validators.createAgentRequestSchema, (0, checkRefs_1.refsChecker)(checkRefs, checkRefs_1.agentRefs));
 }
-function updateAgent(agents) {
-    return (0, updateResource_1.updateResource)(agents, RESOURCE, common_1.Validators.updateAgentRequestSchema);
+function updateAgent(agents, checkRefs) {
+    return (0, updateResource_1.updateResource)(agents, RESOURCE, common_1.Validators.updateAgentRequestSchema, (0, checkRefs_1.refsChecker)(checkRefs, checkRefs_1.agentRefs));
 }
 function getAgent(agents) {
     return (0, getResource_1.getResource)(agents, RESOURCE);

package/dist/domains/buildService.js

@@ -23,9 +23,11 @@ exports.buildService = buildService;
  * limitations under the License.
  */
 const sdk_1 = __importDefault(require("@routr/sdk"));
+const checkRefs_1 = require("../resources/checkRefs");
 const operations_1 = require("./operations");
 function buildService(clientOptions) {
     const client = new sdk_1.default.Domains(clientOptions);
+    const checkRefs = (0, checkRefs_1.createCheckRefs)((0, checkRefs_1.createRefLookups)(clientOptions));
     return {
         definition: {
             serviceName: "Domains",
@@ -34,8 +36,8 @@ function buildService(clientOptions) {
             proto: "domains.proto"
         },
         handlers: {
-            createDomain: (0, operations_1.createDomain)(client),
-            updateDomain: (0, operations_1.updateDomain)(client),
+            createDomain: (0, operations_1.createDomain)(client, checkRefs),
+            updateDomain: (0, operations_1.updateDomain)(client, checkRefs),
             getDomain: (0, operations_1.getDomain)(client),
             listDomains: (0, operations_1.listDomains)(client),
             deleteDomain: (0, operations_1.deleteDomain)(client)

package/dist/domains/operations.d.ts

@@ -1,8 +1,9 @@
 import { DomainsApi } from "@fonoster/types";
-declare function createDomain(domains: DomainsApi): (call: {
+import { CheckRefs } from "../resources/checkRefs";
+declare function createDomain(domains: DomainsApi, checkRefs?: CheckRefs): (call: {
     request: unknown;
 }, callback: (error?: import("@fonoster/common").GrpcErrorMessage, response?: unknown) => void) => Promise<void>;
-declare function updateDomain(domains: DomainsApi): (call: {
+declare function updateDomain(domains: DomainsApi, checkRefs?: CheckRefs): (call: {
     request: unknown;
 }, callback: (error?: import("@fonoster/common").GrpcErrorMessage, response?: unknown) => void) => Promise<void>;
 declare function getDomain(domains: DomainsApi): (call: {

package/dist/domains/operations.js

@@ -24,17 +24,18 @@ exports.updateDomain = updateDomain;
  * limitations under the License.
  */
 const common_1 = require("@fonoster/common");
+const checkRefs_1 = require("../resources/checkRefs");
 const createResource_1 = require("../resources/createResource");
 const deleteResource_1 = require("../resources/deleteResource");
 const getResource_1 = require("../resources/getResource");
 const listResources_1 = require("../resources/listResources");
 const updateResource_1 = require("../resources/updateResource");
 const RESOURCE = "Domain";
-function createDomain(domains) {
-    return (0, createResource_1.createResource)(domains, RESOURCE, common_1.Validators.createDomainRequestSchema);
+function createDomain(domains, checkRefs) {
+    return (0, createResource_1.createResource)(domains, RESOURCE, common_1.Validators.createDomainRequestSchema, (0, checkRefs_1.refsChecker)(checkRefs, checkRefs_1.domainRefs));
 }
-function updateDomain(domains) {
-    return (0, updateResource_1.updateResource)(domains, RESOURCE, common_1.Validators.updateDomainRequestSchema);
+function updateDomain(domains, checkRefs) {
+    return (0, updateResource_1.updateResource)(domains, RESOURCE, common_1.Validators.updateDomainRequestSchema, (0, checkRefs_1.refsChecker)(checkRefs, checkRefs_1.domainRefs));
 }
 function getDomain(domains) {
     return (0, getResource_1.getResource)(domains, RESOURCE);

package/dist/numbers/buildService.d.ts

@@ -18,7 +18,9 @@
  */
 import { NumberPreconditionsCheck } from "@fonoster/common";
 import { ClientOptions } from "../types";
-declare function buildService(clientOptions: ClientOptions, checkNumberPreconditions: NumberPreconditionsCheck): {
+import { NumberRouting } from "./engineRouting";
+/** `routing` picks the peer app-linked numbers point at (default: the media-node peer). */
+declare function buildService(clientOptions: ClientOptions, checkNumberPreconditions: NumberPreconditionsCheck, routing?: NumberRouting): {
     definition: {
         serviceName: string;
         pckg: string;

package/dist/numbers/buildService.js

@@ -5,13 +5,16 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.buildService = buildService;
 const sdk_1 = __importDefault(require("@routr/sdk"));
+const checkRefs_1 = require("../resources/checkRefs");
 const createNumber_1 = require("./createNumber");
 const getNumber_1 = require("./getNumber");
 const listNumbers_1 = require("./listNumbers");
 const operations_1 = require("./operations");
 const updateNumber_1 = require("./updateNumber");
-function buildService(clientOptions, checkNumberPreconditions) {
+/** `routing` picks the peer app-linked numbers point at (default: the media-node peer). */
+function buildService(clientOptions, checkNumberPreconditions, routing) {
     const client = new sdk_1.default.Numbers(clientOptions);
+    const checkRefs = (0, checkRefs_1.createCheckRefs)((0, checkRefs_1.createRefLookups)(clientOptions));
     return {
         definition: {
             serviceName: "Numbers",
@@ -20,8 +23,8 @@ function buildService(clientOptions, checkNumberPreconditions) {
             proto: "numbers.proto"
         },
         handlers: {
-            createNumber: (0, createNumber_1.createNumber)(client, checkNumberPreconditions),
-            updateNumber: (0, updateNumber_1.updateNumber)(client, checkNumberPreconditions),
+            createNumber: (0, createNumber_1.createNumber)(client, checkNumberPreconditions, routing, checkRefs),
+            updateNumber: (0, updateNumber_1.updateNumber)(client, checkNumberPreconditions, routing, checkRefs),
             getNumber: (0, getNumber_1.getNumber)(client),
             listNumbers: (0, listNumbers_1.listNumbers)(client),
             deleteNumber: (0, operations_1.deleteNumber)(client)

package/dist/numbers/convertToRoutrNumber.d.ts

@@ -1,5 +1,9 @@
 import { CreateNumberRequest, UpdateNumberRequest } from "@fonoster/types";
-declare function convertToRoutrNumber(number: CreateNumberRequest, accessKeyId: string): {
+/**
+ * `appPeerAor` is the peer an app-linked number routes to: the media-node peer by default (see
+ * engineRouting.ts).
+ */
+declare function convertToRoutrNumber(number: CreateNumberRequest, accessKeyId: string, appPeerAor?: string): {
     name: string;
     telUrl: string;
     aorLink: string;
@@ -13,7 +17,7 @@ declare function convertToRoutrNumber(number: CreateNumberRequest, accessKeyId:
     trunkRef: string;
     extended: Record<string, unknown>;
 };
-declare function convertToRoutrNumberUpdate(number: UpdateNumberRequest): {
+declare function convertToRoutrNumberUpdate(number: UpdateNumberRequest, appPeerAor?: string): {
     ref: string;
     name: string;
     aorLink: string;

package/dist/numbers/convertToRoutrNumber.js

@@ -21,8 +21,12 @@ exports.convertToRoutrNumberUpdate = convertToRoutrNumberUpdate;
  * limitations under the License.
  */
 const common_1 = require("@fonoster/common");
-function convertToRoutrNumber(number, accessKeyId) {
-    const aorLink = number.appRef ? common_1.ROUTR_DEFAULT_PEER_AOR : number.agentAor;
+/**
+ * `appPeerAor` is the peer an app-linked number routes to: the media-node peer by default (see
+ * engineRouting.ts).
+ */
+function convertToRoutrNumber(number, accessKeyId, appPeerAor = common_1.ROUTR_DEFAULT_PEER_AOR) {
+    const aorLink = number.appRef ? appPeerAor : number.agentAor;
     return {
         name: number.name,
         telUrl: number.telUrl,
@@ -42,11 +46,11 @@ function convertToRoutrNumber(number, accessKeyId) {
         extended: { accessKeyId }
     };
 }
-function convertToRoutrNumberUpdate(number) {
+function convertToRoutrNumberUpdate(number, appPeerAor = common_1.ROUTR_DEFAULT_PEER_AOR) {
     let aorLink;
     let extraHeaders = [];
     if (number.appRef) {
-        aorLink = common_1.ROUTR_DEFAULT_PEER_AOR;
+        aorLink = appPeerAor;
         extraHeaders.push({
             name: common_1.APP_REF_HEADER,
             value: number.appRef

package/dist/numbers/createNumber.d.ts

@@ -18,7 +18,9 @@
  */
 import { GrpcErrorMessage, NumberPreconditionsCheck } from "@fonoster/common";
 import { NumbersApi } from "@fonoster/types";
-declare function createNumber(api: NumbersApi, checkNumberPreconditions: NumberPreconditionsCheck): (call: {
+import { CheckRefs } from "../resources/checkRefs";
+import { NumberRouting } from "./engineRouting";
+declare function createNumber(api: NumbersApi, checkNumberPreconditions: NumberPreconditionsCheck, routing?: NumberRouting, checkRefs?: CheckRefs): (call: {
     request: unknown;
 }, callback: (error?: import("@fonoster/common").GrpcErrorMessage, response?: unknown) => void) => Promise<void>;
 export { createNumber };

package/dist/numbers/createNumber.js

@@ -30,16 +30,25 @@ exports.createNumber = createNumber;
  */
 const common_1 = require("@fonoster/common");
 const logger_1 = require("@fonoster/logger");
+const checkRefs_1 = require("../resources/checkRefs");
 const convertToRoutrNumber_1 = require("./convertToRoutrNumber");
 const logger = (0, logger_1.getLogger)({ service: "sipnet", filePath: __filename });
-function createNumber(api, checkNumberPreconditions) {
+function createNumber(api, checkNumberPreconditions, routing, checkRefs) {
     const fn = (call, callback) => __awaiter(this, void 0, void 0, function* () {
         const { request } = call;
-        // Validates that the appRef or agentAor exists in the system
-        yield checkNumberPreconditions(request);
         const accessKeyId = (0, common_1.getAccessKeyIdFromCall)(call);
+        // Validates that the appRef exists in the caller's workspace (RV-B4)
+        yield checkNumberPreconditions(Object.assign(Object.assign({}, request), { accessKeyId }));
+        // ...and the trunk too (H7)
+        yield (checkRefs === null || checkRefs === void 0 ? void 0 : checkRefs(accessKeyId, (0, checkRefs_1.numberRefs)(request)));
         logger.verbose("call to createNumber", Object.assign(Object.assign({}, request), { accessKeyId }));
-        const response = yield api.createNumber((0, convertToRoutrNumber_1.convertToRoutrNumber)(request, accessKeyId));
+        const appPeerAor = routing && request.appRef
+            ? yield routing.aorFor({
+                appRef: request.appRef,
+                telUrl: request.telUrl
+            })
+            : undefined;
+        const response = yield api.createNumber((0, convertToRoutrNumber_1.convertToRoutrNumber)(request, accessKeyId, appPeerAor));
         callback(null, response);
     });
     return (0, common_1.withErrorHandlingAndValidation)(fn, common_1.Validators.createNumberRequestSchema);

package/dist/numbers/engineRouting.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Where app-linked numbers point (add-media-node 4.1). Asterisk is retired (cleanbreak CB-B3):
+ * every app-linked number goes to the media-node peer that Go media nodes register under with
+ * least-sessions. `rebuild` is the only engine left; the type stays so repoint reports keep
+ * their shape.
+ */
+export type VoiceEngine = "rebuild";
+export type EngineRoutingConfig = {
+    /** The media-node peer AOR (default sip:medianode@default). */
+    mediaNodeAor?: string;
+};
+export declare const MEDIA_NODE_PEER_AOR = "sip:medianode@default";
+/** The AOR of the retired Asterisk peer, for moving numbers created before the rebuild. */
+export declare const LEGACY_ASTERISK_PEER_AOR = "sip:voice@default";
+export type NumberRouting = {
+    /** The engine for an app-linked number. */
+    engineFor(target: {
+        appRef: string;
+        telUrl?: string;
+    }): Promise<VoiceEngine>;
+    /** The peer AOR (Number.aorLink) for an app-linked number. */
+    aorFor(target: {
+        appRef: string;
+        telUrl?: string;
+    }): Promise<string>;
+    /** The peer AOR of an engine. */
+    aorOf(engine: VoiceEngine): string;
+};
+export declare function createNumberRouting(config?: EngineRoutingConfig): NumberRouting;

package/dist/numbers/engineRouting.js

@@ -0,0 +1,44 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LEGACY_ASTERISK_PEER_AOR = exports.MEDIA_NODE_PEER_AOR = void 0;
+exports.createNumberRouting = createNumberRouting;
+/**
+ * Copyright (C) 2025 by Fonoster Inc (https://fonoster.com)
+ * http://github.com/fonoster/fonoster
+ *
+ * This file is part of Fonoster
+ *
+ * Licensed under the MIT License (the "License");
+ * you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ *    https://opensource.org/licenses/MIT
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+const common_1 = require("@fonoster/common");
+exports.MEDIA_NODE_PEER_AOR = common_1.ROUTR_DEFAULT_PEER_AOR;
+/** The AOR of the retired Asterisk peer, for moving numbers created before the rebuild. */
+exports.LEGACY_ASTERISK_PEER_AOR = "sip:voice@default";
+function createNumberRouting(config = {}) {
+    var _a;
+    const aor = (_a = config.mediaNodeAor) !== null && _a !== void 0 ? _a : exports.MEDIA_NODE_PEER_AOR;
+    return {
+        engineFor: () => __awaiter(this, void 0, void 0, function* () { return "rebuild"; }),
+        aorFor: () => __awaiter(this, void 0, void 0, function* () { return aor; }),
+        aorOf: () => aor
+    };
+}

package/dist/numbers/getNumber.d.ts

@@ -1,22 +1,3 @@
-/**
- * Copyright (C) 2025 by Fonoster Inc (https://fonoster.com)
- * http://github.com/fonoster/fonoster
- *
- * This file is part of Fonoster
- *
- * Licensed under the MIT License (the "License");
- * you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- *
- *    https://opensource.org/licenses/MIT
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-import { GrpcErrorMessage } from "@fonoster/common";
 import { NumbersApi } from "@fonoster/types";
 declare function getNumber(api: NumbersApi): (call: {
     request: unknown;

package/dist/numbers/getNumber.js

@@ -29,16 +29,16 @@ exports.getNumber = getNumber;
  * limitations under the License.
  */
 const common_1 = require("@fonoster/common");
+const identity_1 = require("@fonoster/identity");
 const logger_1 = require("@fonoster/logger");
 const convertToFonosterNumber_1 = require("./convertToFonosterNumber");
 const logger = (0, logger_1.getLogger)({ service: "sipnet", filePath: __filename });
 function getNumber(api) {
-    const fn = (call, callback) => __awaiter(this, void 0, void 0, function* () {
-        const { request } = call;
-        const { ref } = request;
+    const fn = (call) => __awaiter(this, void 0, void 0, function* () {
+        const { ref } = call.request;
         logger.verbose("call to getNumber", { ref });
-        const response = yield api.getNumber(ref);
-        callback(null, (0, convertToFonosterNumber_1.convertToFonosterNumber)(response));
+        return (0, convertToFonosterNumber_1.convertToFonosterNumber)(yield api.getNumber(ref));
     });
-    return (0, common_1.withErrorHandlingAndValidation)(fn, common_1.Validators.emptySchema);
+    // Only the caller's own numbers can be read, like every other resource.
+    return (0, common_1.withErrorHandlingAndValidation)((0, identity_1.withAccess)(fn, ((ref) => api.getNumber(ref))), common_1.Validators.emptySchema);
 }

package/dist/numbers/index.d.ts

@@ -17,3 +17,5 @@
  * limitations under the License.
  */
 export { buildService as buildNumbersService } from "./buildService";
+export * from "./engineRouting";
+export * from "./repointNumbers";

package/dist/numbers/index.js

@@ -1,4 +1,18 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.buildNumbersService = void 0;
 /**
@@ -21,3 +35,5 @@ exports.buildNumbersService = void 0;
  */
 var buildService_1 = require("./buildService");
 Object.defineProperty(exports, "buildNumbersService", { enumerable: true, get: function () { return buildService_1.buildService; } });
+__exportStar(require("./engineRouting"), exports);
+__exportStar(require("./repointNumbers"), exports);

package/dist/numbers/repointNumbers.d.ts

@@ -0,0 +1,49 @@
+import { NumberRouting, VoiceEngine } from "./engineRouting";
+/** The slice of Routr's Numbers API that repointing needs (`new SDK.Numbers(...)` fits). */
+export type RoutrNumbersClient = {
+    listNumbers(request: {
+        pageSize: number;
+        pageToken?: string;
+    }): Promise<{
+        items: RoutrNumber[];
+        nextPageToken?: string;
+    }>;
+    updateNumber(request: {
+        ref: string;
+        name: string;
+        aorLink: string;
+        extraHeaders?: {
+            name: string;
+            value: string;
+        }[];
+    }): Promise<unknown>;
+};
+export type RoutrNumber = {
+    ref: string;
+    name: string;
+    telUrl: string;
+    aorLink?: string;
+    extraHeaders?: {
+        name: string;
+        value: string;
+    }[];
+};
+export type RepointChange = {
+    ref: string;
+    telUrl: string;
+    appRef: string;
+    engine: VoiceEngine;
+    from?: string;
+    to: string;
+};
+/**
+ * Moves app-linked Numbers to the peer routing says (the media nodes). Routr stores `aorLink` on
+ * each Number, so numbers created for Asterisk keep pointing at it until they are rewritten;
+ * agent-linked Numbers are never touched. Returns what changed (or would,
+ * with `dryRun`).
+ */
+export declare function repointNumbers(client: RoutrNumbersClient, routing: NumberRouting, options?: {
+    appRefs?: string[];
+    dryRun?: boolean;
+    pageSize?: number;
+}): Promise<RepointChange[]>;

package/dist/numbers/repointNumbers.js

@@ -0,0 +1,83 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.repointNumbers = repointNumbers;
+/**
+ * Copyright (C) 2025 by Fonoster Inc (https://fonoster.com)
+ * http://github.com/fonoster/fonoster
+ *
+ * This file is part of Fonoster
+ *
+ * Licensed under the MIT License (the "License");
+ * you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ *    https://opensource.org/licenses/MIT
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+const common_1 = require("@fonoster/common");
+/**
+ * Moves app-linked Numbers to the peer routing says (the media nodes). Routr stores `aorLink` on
+ * each Number, so numbers created for Asterisk keep pointing at it until they are rewritten;
+ * agent-linked Numbers are never touched. Returns what changed (or would,
+ * with `dryRun`).
+ */
+function repointNumbers(client_1, routing_1) {
+    return __awaiter(this, arguments, void 0, function* (client, routing, options = {}) {
+        var _a, _b, _c;
+        const changes = [];
+        let pageToken;
+        const numbers = [];
+        do {
+            const page = yield client.listNumbers({
+                pageSize: (_a = options.pageSize) !== null && _a !== void 0 ? _a : 100,
+                pageToken
+            });
+            numbers.push(...page.items);
+            pageToken = page.nextPageToken || undefined;
+        } while (pageToken);
+        for (const n of numbers) {
+            // Header names are case-insensitive (sipnet writes x-app-ref; operators may write X-App-Ref).
+            const appRef = (_c = (_b = n.extraHeaders) === null || _b === void 0 ? void 0 : _b.find((h) => h.name.toLowerCase() === common_1.APP_REF_HEADER.toLowerCase())) === null || _c === void 0 ? void 0 : _c.value;
+            if (!appRef)
+                continue;
+            if (options.appRefs && !options.appRefs.includes(appRef))
+                continue;
+            const engine = yield routing.engineFor({ appRef, telUrl: n.telUrl });
+            const to = routing.aorOf(engine);
+            if (n.aorLink === to)
+                continue;
+            changes.push({
+                ref: n.ref,
+                telUrl: n.telUrl,
+                appRef,
+                engine,
+                from: n.aorLink,
+                to
+            });
+            if (!options.dryRun) {
+                // Routr's update needs the name; extra headers are kept as they are.
+                yield client.updateNumber({
+                    ref: n.ref,
+                    name: n.name,
+                    aorLink: to,
+                    extraHeaders: n.extraHeaders
+                });
+            }
+        }
+        return changes;
+    });
+}

package/dist/numbers/repointNumbersCli.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/numbers/repointNumbersCli.js

@@ -0,0 +1,106 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * Copyright (C) 2025 by Fonoster Inc (https://fonoster.com)
+ * http://github.com/fonoster/fonoster
+ *
+ * This file is part of Fonoster
+ *
+ * Licensed under the MIT License (the "License");
+ * you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ *    https://opensource.org/licenses/MIT
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+const fs = __importStar(require("fs"));
+const sdk_1 = __importDefault(require("@routr/sdk"));
+const engineRouting_1 = require("./engineRouting");
+const repointNumbers_1 = require("./repointNumbers");
+/**
+ * Moves app-linked Numbers created before the rebuild (pointing at Asterisk's sip:voice@default)
+ * to the media-node peer:
+ *
+ *   node dist/numbers/repointNumbersCli.js <routing.json> [--apply] [--app <ref>]...
+ *
+ * routing.json holds an EngineRoutingConfig ({ mediaNodeAor }); `{}` uses sip:medianode@default.
+ * Without --apply it only prints what would change. ROUTR_API_ENDPOINT (default routr:51907)
+ * points at Routr's API.
+ */
+function main(argv) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        const file = argv[0];
+        if (!file) {
+            console.error("usage: repointNumbersCli <routing.json> [--apply] [--app <ref>]...");
+            process.exit(2);
+        }
+        const config = JSON.parse(fs.readFileSync(file, "utf8"));
+        const appRefs = argv
+            .map((a, i) => (a === "--app" ? argv[i + 1] : undefined))
+            .filter((a) => !!a);
+        const client = new sdk_1.default.Numbers({
+            endpoint: (_a = process.env.ROUTR_API_ENDPOINT) !== null && _a !== void 0 ? _a : "routr:51907",
+            insecure: true
+        });
+        const changes = yield (0, repointNumbers_1.repointNumbers)(client, (0, engineRouting_1.createNumberRouting)(config), {
+            dryRun: !argv.includes("--apply"),
+            appRefs: appRefs.length ? appRefs : undefined
+        });
+        console.log(JSON.stringify({ applied: argv.includes("--apply"), changes }, null, 2));
+    });
+}
+main(process.argv.slice(2)).catch((e) => {
+    console.error(e.message);
+    process.exit(1);
+});

package/dist/numbers/updateNumber.d.ts

@@ -16,9 +16,11 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-import { GrpcErrorMessage, NumberPreconditionsCheck } from "@fonoster/common";
+import { NumberPreconditionsCheck } from "@fonoster/common";
 import { NumbersApi } from "@fonoster/types";
-declare function updateNumber(api: NumbersApi, checkNumberPreconditions: NumberPreconditionsCheck): (call: {
+import { CheckRefs } from "../resources/checkRefs";
+import { NumberRouting } from "./engineRouting";
+declare function updateNumber(api: NumbersApi, checkNumberPreconditions: NumberPreconditionsCheck, routing?: NumberRouting, checkRefs?: CheckRefs): (call: {
     request: unknown;
 }, callback: (error?: import("@fonoster/common").GrpcErrorMessage, response?: unknown) => void) => Promise<void>;
 export { updateNumber };

package/dist/numbers/updateNumber.js

@@ -29,17 +29,30 @@ exports.updateNumber = updateNumber;
  * limitations under the License.
  */
 const common_1 = require("@fonoster/common");
+const identity_1 = require("@fonoster/identity");
 const logger_1 = require("@fonoster/logger");
+const checkRefs_1 = require("../resources/checkRefs");
 const convertToRoutrNumber_1 = require("./convertToRoutrNumber");
 const logger = (0, logger_1.getLogger)({ service: "sipnet", filePath: __filename });
-function updateNumber(api, checkNumberPreconditions) {
-    const fn = (call, callback) => __awaiter(this, void 0, void 0, function* () {
+function updateNumber(api, checkNumberPreconditions, routing, checkRefs) {
+    const fn = (call) => __awaiter(this, void 0, void 0, function* () {
+        var _a;
         const { request } = call;
-        // Validates that the appRef or agentAor exists in the system
-        yield checkNumberPreconditions(request);
+        // Validates that the appRef exists in the caller's workspace (RV-B4)
+        const accessKeyId = (0, common_1.getAccessKeyIdFromCall)(call);
+        yield checkNumberPreconditions(Object.assign(Object.assign({}, request), { accessKeyId }));
+        // ...and the trunk too (H7)
+        yield (checkRefs === null || checkRefs === void 0 ? void 0 : checkRefs(accessKeyId, (0, checkRefs_1.numberRefs)(request)));
         logger.verbose("call to updateNumber", Object.assign({}, request));
-        const response = yield api.updateNumber((0, convertToRoutrNumber_1.convertToRoutrNumberUpdate)(request));
-        callback(null, response);
+        // The number's telUrl matters only for per-number pins, so it is read only with routing.
+        const appPeerAor = routing && request.appRef
+            ? yield routing.aorFor({
+                appRef: request.appRef,
+                telUrl: (_a = (yield api.getNumber(request.ref))) === null || _a === void 0 ? void 0 : _a.telUrl
+            })
+            : undefined;
+        return yield api.updateNumber((0, convertToRoutrNumber_1.convertToRoutrNumberUpdate)(request, appPeerAor));
     });
-    return (0, common_1.withErrorHandlingAndValidation)(fn, common_1.Validators.updateNumberRequestSchema);
+    // Only the caller's own numbers can be updated, like every other resource.
+    return (0, common_1.withErrorHandlingAndValidation)((0, identity_1.withAccess)(fn, ((ref) => api.getNumber(ref))), common_1.Validators.updateNumberRequestSchema);
 }

package/dist/resources/checkRefs.d.ts

@@ -0,0 +1,26 @@
+import { ClientOptions } from "../types";
+type RefKind = "Acl" | "Credentials" | "Domain" | "Number" | "Trunk";
+type OwnedResource = {
+    extended?: Record<string, unknown> | null;
+} | null | undefined;
+type RefLookups = Record<RefKind, (ref: string) => Promise<OwnedResource>>;
+/** One reference in a request: the request field, what it names and its value. */
+type RefField = {
+    field: string;
+    kind: RefKind;
+    ref?: string | null;
+};
+type CheckRefs = (accessKeyId: string | undefined, refs: RefField[]) => Promise<void>;
+/** A request's references, checked before it reaches Routr. */
+type CheckRequestRefs<R> = (request: R, accessKeyId: string | undefined) => Promise<void>;
+declare function createCheckRefs(lookups: Partial<RefLookups>): CheckRefs;
+/** The production lookups: Routr's API, one client per kind. */
+declare function createRefLookups(clientOptions: ClientOptions): RefLookups;
+type Refs = Record<string, unknown>;
+declare const agentRefs: (r: Refs) => RefField[];
+declare const trunkRefs: (r: Refs) => RefField[];
+declare const domainRefs: (r: Refs) => RefField[];
+declare const numberRefs: (r: Refs) => RefField[];
+/** The reference check for one resource type's requests. */
+declare function refsChecker<R>(checkRefs: CheckRefs | undefined, refsOf: (request: Refs) => RefField[]): CheckRequestRefs<R> | undefined;
+export { agentRefs, CheckRefs, CheckRequestRefs, createCheckRefs, createRefLookups, domainRefs, numberRefs, RefField, RefKind, RefLookups, refsChecker, trunkRefs };

package/dist/resources/checkRefs.js

@@ -0,0 +1,138 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.trunkRefs = exports.numberRefs = exports.domainRefs = exports.agentRefs = void 0;
+exports.createCheckRefs = createCheckRefs;
+exports.createRefLookups = createRefLookups;
+exports.refsChecker = refsChecker;
+/**
+ * Copyright (C) 2025 by Fonoster Inc (https://fonoster.com)
+ * http://github.com/fonoster/fonoster
+ *
+ * This file is part of Fonoster
+ *
+ * Licensed under the MIT License (the "License");
+ * you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ *    https://opensource.org/licenses/MIT
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+const common_1 = require("@fonoster/common");
+const grpc_js_1 = require("@grpc/grpc-js");
+const sdk_1 = __importDefault(require("@routr/sdk"));
+const isNotFound = (e) => (e === null || e === void 0 ? void 0 : e.code) === grpc_js_1.status.NOT_FOUND;
+function createCheckRefs(lookups) {
+    return (accessKeyId, refs) => __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        const given = refs.filter((r) => typeof r.ref === "string" && r.ref !== "");
+        if (given.length === 0)
+            return;
+        if (!accessKeyId) {
+            throw new common_1.GrpcError(grpc_js_1.status.PERMISSION_DENIED, "the caller's workspace is required to reference other resources");
+        }
+        for (const { field, kind, ref } of given) {
+            const lookup = lookups[kind];
+            if (!lookup)
+                throw new Error(`no lookup for ${kind} references`);
+            let resource;
+            try {
+                resource = yield lookup(ref);
+            }
+            catch (e) {
+                if (!isNotFound(e))
+                    throw e;
+                resource = undefined;
+            }
+            // Another workspace's resource is reported like a missing one, so refs of other
+            // workspaces are not confirmed.
+            if (((_a = resource === null || resource === void 0 ? void 0 : resource.extended) === null || _a === void 0 ? void 0 : _a.accessKeyId) !== accessKeyId) {
+                throw new common_1.GrpcError(grpc_js_1.status.INVALID_ARGUMENT, `${field} ${ref} not found`);
+            }
+        }
+    });
+}
+/** The production lookups: Routr's API, one client per kind. */
+function createRefLookups(clientOptions) {
+    const acls = new sdk_1.default.Acls(clientOptions);
+    const credentials = new sdk_1.default.Credentials(clientOptions);
+    const domains = new sdk_1.default.Domains(clientOptions);
+    const numbers = new sdk_1.default.Numbers(clientOptions);
+    const trunks = new sdk_1.default.Trunks(clientOptions);
+    return {
+        Acl: (ref) => acls.getAcl(ref),
+        Credentials: (ref) => credentials.getCredentials(ref),
+        Domain: (ref) => domains.getDomain(ref),
+        Number: (ref) => numbers.getNumber(ref),
+        Trunk: (ref) => trunks.getTrunk(ref)
+    };
+}
+const agentRefs = (r) => [
+    { field: "domainRef", kind: "Domain", ref: r.domainRef },
+    {
+        field: "credentialsRef",
+        kind: "Credentials",
+        ref: r.credentialsRef
+    }
+];
+exports.agentRefs = agentRefs;
+const trunkRefs = (r) => [
+    {
+        field: "accessControlListRef",
+        kind: "Acl",
+        ref: r.accessControlListRef
+    },
+    {
+        field: "inboundCredentialsRef",
+        kind: "Credentials",
+        ref: r.inboundCredentialsRef
+    },
+    {
+        field: "outboundCredentialsRef",
+        kind: "Credentials",
+        ref: r.outboundCredentialsRef
+    }
+];
+exports.trunkRefs = trunkRefs;
+const domainRefs = (r) => {
+    var _a;
+    return [
+        {
+            field: "accessControlListRef",
+            kind: "Acl",
+            ref: r.accessControlListRef
+        },
+        ...((_a = r.egressPolicies) !== null && _a !== void 0 ? _a : []).map((p, i) => ({
+            field: `egressPolicies[${i}].numberRef`,
+            kind: "Number",
+            ref: p === null || p === void 0 ? void 0 : p.numberRef
+        }))
+    ];
+};
+exports.domainRefs = domainRefs;
+const numberRefs = (r) => [
+    { field: "trunkRef", kind: "Trunk", ref: r.trunkRef }
+];
+exports.numberRefs = numberRefs;
+/** The reference check for one resource type's requests. */
+function refsChecker(checkRefs, refsOf) {
+    return checkRefs
+        ? (request, accessKeyId) => checkRefs(accessKeyId, refsOf(request))
+        : undefined;
+}

package/dist/resources/createResource.d.ts

@@ -18,7 +18,8 @@
  */
 import { GrpcErrorMessage } from "@fonoster/common";
 import { z } from "zod";
-declare function createResource<T, R, U>(api: U, resource: string, schema: z.ZodSchema): (call: {
+import { CheckRequestRefs } from "./checkRefs";
+declare function createResource<T, R, U>(api: U, resource: string, schema: z.ZodSchema, checkRefs?: CheckRequestRefs<R>): (call: {
     request: unknown;
 }, callback: (error?: import("@fonoster/common").GrpcErrorMessage, response?: unknown) => void) => Promise<void>;
 export { createResource };

package/dist/resources/createResource.js

@@ -31,11 +31,14 @@ exports.createResource = createResource;
 const common_1 = require("@fonoster/common");
 const logger_1 = require("@fonoster/logger");
 const logger = (0, logger_1.getLogger)({ service: "sipnet", filePath: __filename });
-function createResource(api, resource, schema) {
+function createResource(api, resource, schema, checkRefs) {
     const fn = (call, callback) => __awaiter(this, void 0, void 0, function* () {
         const { request } = call;
         const accessKeyId = (0, common_1.getAccessKeyIdFromCall)(call);
-        logger.verbose(`call to create${resource}`, Object.assign(Object.assign({}, request), { accessKeyId }));
+        // Never the request itself: credentials and trunks carry passwords (M11).
+        logger.verbose(`call to create${resource}`, { accessKeyId });
+        // Referenced credentials, ACLs, domains, numbers and trunks must be the caller's (H7).
+        yield (checkRefs === null || checkRefs === void 0 ? void 0 : checkRefs(request, accessKeyId));
         const response = yield api[`create${resource}`](Object.assign(Object.assign({}, request), { extended: {
                 accessKeyId
             } }));

package/dist/resources/updateResource.d.ts

@@ -1,5 +1,6 @@
 import { z } from "zod";
-declare function updateResource<T, R, U>(api: U, resource: string, schema: z.ZodSchema): (call: {
+import { CheckRequestRefs } from "./checkRefs";
+declare function updateResource<T, R, U>(api: U, resource: string, schema: z.ZodSchema, checkRefs?: CheckRequestRefs<R>): (call: {
     request: unknown;
 }, callback: (error?: import("@fonoster/common").GrpcErrorMessage, response?: unknown) => void) => Promise<void>;
 export { updateResource };

package/dist/resources/updateResource.js

@@ -32,10 +32,15 @@ const common_1 = require("@fonoster/common");
 const identity_1 = require("@fonoster/identity");
 const logger_1 = require("@fonoster/logger");
 const logger = (0, logger_1.getLogger)({ service: "sipnet", filePath: __filename });
-function updateResource(api, resource, schema) {
+function updateResource(api, resource, schema, checkRefs) {
     const fn = (call) => __awaiter(this, void 0, void 0, function* () {
         const { request } = call;
-        logger.verbose(`call to update${resource}`, Object.assign({}, request));
+        // Never the request itself: credentials and trunks carry passwords (M11).
+        logger.verbose(`call to update${resource}`, {
+            ref: request.ref
+        });
+        // Referenced credentials, ACLs, domains, numbers and trunks must be the caller's (H7).
+        yield (checkRefs === null || checkRefs === void 0 ? void 0 : checkRefs(request, (0, common_1.getAccessKeyIdFromCall)(call)));
         return yield api[`update${resource}`](request);
     });
     return (0, common_1.withErrorHandlingAndValidation)((0, identity_1.withAccess)(fn, (ref) => api[`get${resource}`](ref)), schema);

package/dist/trunks/buildService.js

@@ -23,9 +23,11 @@ exports.buildService = buildService;
  * limitations under the License.
  */
 const sdk_1 = __importDefault(require("@routr/sdk"));
+const checkRefs_1 = require("../resources/checkRefs");
 const operations_1 = require("./operations");
 function buildService(clientOptions) {
     const client = new sdk_1.default.Trunks(clientOptions);
+    const checkRefs = (0, checkRefs_1.createCheckRefs)((0, checkRefs_1.createRefLookups)(clientOptions));
     return {
         definition: {
             serviceName: "Trunks",
@@ -34,8 +36,8 @@ function buildService(clientOptions) {
             proto: "trunks.proto"
         },
         handlers: {
-            createTrunk: (0, operations_1.createTrunk)(client),
-            updateTrunk: (0, operations_1.updateTrunk)(client),
+            createTrunk: (0, operations_1.createTrunk)(client, checkRefs),
+            updateTrunk: (0, operations_1.updateTrunk)(client, checkRefs),
             getTrunk: (0, operations_1.getTrunk)(client),
             listTrunks: (0, operations_1.listTrunks)(client),
             deleteTrunk: (0, operations_1.deleteTrunk)(client)

package/dist/trunks/operations.d.ts

@@ -1,8 +1,15 @@
-import { TrunkApi } from "@fonoster/types";
-declare function createTrunk(trunks: TrunkApi): (call: {
+import { TrunkApi, TrunkExtended, UpdateTrunkRequest } from "@fonoster/types";
+import { CheckRefs } from "../resources/checkRefs";
+declare function createTrunk(trunks: TrunkApi, checkRefs?: CheckRefs): (call: {
     request: unknown;
 }, callback: (error?: import("@fonoster/common").GrpcErrorMessage, response?: unknown) => void) => Promise<void>;
-declare function updateTrunk(trunks: TrunkApi): (call: {
+/**
+ * A partial update: fields the request leaves blank keep their current value (proto3 sends ""
+ * and [] for fields not set, and Routr rejects a trunk without a name or inbound URI). Clearing
+ * the URIs or a reference through an update is therefore not possible; recreate the trunk.
+ */
+export declare function mergeTrunkUpdate(request: UpdateTrunkRequest, current: Partial<TrunkExtended>): UpdateTrunkRequest;
+declare function updateTrunk(trunks: TrunkApi, checkRefs?: CheckRefs): (call: {
     request: unknown;
 }, callback: (error?: import("@fonoster/common").GrpcErrorMessage, response?: unknown) => void) => Promise<void>;
 declare function getTrunk(trunks: TrunkApi): (call: {

package/dist/trunks/operations.js

@@ -1,5 +1,15 @@
 "use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.mergeTrunkUpdate = mergeTrunkUpdate;
 exports.createTrunk = createTrunk;
 exports.deleteTrunk = deleteTrunk;
 exports.getTrunk = getTrunk;
@@ -24,17 +34,43 @@ exports.updateTrunk = updateTrunk;
  * limitations under the License.
  */
 const common_1 = require("@fonoster/common");
+const checkRefs_1 = require("../resources/checkRefs");
 const createResource_1 = require("../resources/createResource");
 const deleteResource_1 = require("../resources/deleteResource");
 const getResource_1 = require("../resources/getResource");
 const listResources_1 = require("../resources/listResources");
 const updateResource_1 = require("../resources/updateResource");
 const RESOURCE = "Trunk";
-function createTrunk(trunks) {
-    return (0, createResource_1.createResource)(trunks, RESOURCE, common_1.Validators.createTrunkRequestSchema);
+function createTrunk(trunks, checkRefs) {
+    return (0, createResource_1.createResource)(trunks, RESOURCE, common_1.Validators.createTrunkRequestSchema, (0, checkRefs_1.refsChecker)(checkRefs, checkRefs_1.trunkRefs));
 }
-function updateTrunk(trunks) {
-    return (0, updateResource_1.updateResource)(trunks, RESOURCE, common_1.Validators.updateTrunkRequestSchema);
+const blank = (v) => v === undefined || v === null || v === "" || (Array.isArray(v) && !v.length);
+/**
+ * A partial update: fields the request leaves blank keep their current value (proto3 sends ""
+ * and [] for fields not set, and Routr rejects a trunk without a name or inbound URI). Clearing
+ * the URIs or a reference through an update is therefore not possible; recreate the trunk.
+ */
+function mergeTrunkUpdate(request, current) {
+    const merged = Object.assign({}, request);
+    for (const key of [
+        "name",
+        "inboundUri",
+        "accessControlListRef",
+        "inboundCredentialsRef",
+        "outboundCredentialsRef",
+        "uris"
+    ]) {
+        const value = current[key];
+        if (blank(merged[key]) && !blank(value))
+            merged[key] = value;
+    }
+    return merged;
+}
+function updateTrunk(trunks, checkRefs) {
+    const partial = Object.assign(Object.assign({}, trunks), { getTrunk: (ref) => trunks.getTrunk(ref), updateTrunk: (request) => __awaiter(this, void 0, void 0, function* () {
+            return trunks.updateTrunk(mergeTrunkUpdate(request, yield trunks.getTrunk(request.ref)));
+        }) });
+    return (0, updateResource_1.updateResource)(partial, RESOURCE, common_1.Validators.updateTrunkRequestSchema, (0, checkRefs_1.refsChecker)(checkRefs, checkRefs_1.trunkRefs));
 }
 function getTrunk(trunks) {
     return (0, getResource_1.getResource)(trunks, RESOURCE);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fonoster/sipnet",
-  "version": "0.27.0",
+  "version": "0.30.0",
   "description": "Routr-based SIP stack",
   "author": "Pedro Sanders <psanders@fonoster.com>",
   "homepage": "https://github.com/fonoster/fonoster#readme",
@@ -20,12 +20,12 @@
     "fonoster": "./dist/index.js"
   },
   "dependencies": {
-    "@fonoster/common": "^0.27.0",
-    "@fonoster/identity": "^0.27.0",
-    "@fonoster/logger": "^0.27.0",
-    "@fonoster/types": "^0.27.0",
-    "@grpc/grpc-js": "~1.10.6",
-    "@routr/sdk": "2.13.1",
+    "@fonoster/common": "^0.30.0",
+    "@fonoster/identity": "^0.30.0",
+    "@fonoster/logger": "^0.30.0",
+    "@fonoster/types": "^0.30.0",
+    "@grpc/grpc-js": "~1.14.6",
+    "@routr/sdk": "2.15.2",
     "zod": "^3.23.8"
   },
   "files": [
@@ -41,5 +41,5 @@
   "bugs": {
     "url": "https://github.com/fonoster/fonoster/issues"
   },
-  "gitHead": "1191b34677b51a36000177887ff82303ef2693e1"
+  "gitHead": "b59b06a3ef325abe3f188c0fb87cc22d50ed5471"
 }