sipgate-mcp 0.3.0 → 0.5.0

package/dist/backend/access-controlled-backend.js

@@ -16,15 +16,65 @@ function stringField(value, key) {
     const field = value[key];
     return typeof field === "string" ? field : undefined;
 }
+function stringOrNumberField(value, key) {
+    const field = value[key];
+    return typeof field === "string" || typeof field === "number" ? String(field) : undefined;
+}
+function addressIds(value) {
+    const direct = ["addressId", "emergencyAddressId"]
+        .map((key) => stringOrNumberField(value, key))
+        .filter((id) => Boolean(id));
+    const addressUrl = stringField(value, "addressUrl");
+    const fromUrl = addressUrl?.match(/\/addresses\/(\d+)(?:\/|$)/)?.[1];
+    return fromUrl ? [...direct, fromUrl] : direct;
+}
 function items(value) {
     return objectArray(asObject(value)?.items);
 }
+function calls(value) {
+    return objectArray(asObject(value)?.data);
+}
+function nestedNotificationIds(value) {
+    const found = new Set();
+    const response = asObject(value);
+    if (!response)
+        return found;
+    for (const category of ["call", "fax", "sms", "voicemail"]) {
+        for (const endpoint of objectArray(response[category])) {
+            for (const targetType of ["emails", "sms", "reports"]) {
+                for (const target of objectArray(endpoint[targetType])) {
+                    const notificationId = stringField(target, "id");
+                    if (notificationId)
+                        found.add(notificationId);
+                }
+            }
+        }
+    }
+    return found;
+}
 function withAccessScope(value, context, scope) {
     const object = asObject(value);
     return object
         ? { ...object, accessScope: scope }
         : { value, authenticatedUser: context.identity, accessScope: scope };
 }
+function unavailablePhonelineRead(items = false) {
+    return {
+        ...(items ? { items: [] } : {}),
+        phonelinesAvailable: false,
+        note: "This sipgate account does not provide the phoneline feature.",
+    };
+}
+function unavailablePhonelineMutation() {
+    return {
+        before: null,
+        after: {
+            changed: false,
+            phonelinesAvailable: false,
+            note: "This sipgate account does not provide the phoneline feature; no change was attempted.",
+        },
+    };
+}
 /**
  * Enforces MCP-level resource boundaries in addition to sipgate's own role and
  * token-scope checks. Account scope is rejected unless sipgate identifies the
@@ -70,16 +120,215 @@ export class AccessControlledBackend {
         this.assertUser(userId);
         return this.delegate.listUserNumbers(userId, pagination);
     }
+    getUserNumbers(userId) {
+        this.assertUser(userId);
+        return this.delegate.getUserNumbers(userId);
+    }
     listPhonelines(userId) {
         this.assertUser(userId);
         return this.delegate.listPhonelines(userId);
     }
+    async getPhoneline(userId, phonelineId) {
+        this.assertUser(userId);
+        if (this.scope === "user" && !await this.assertOwnedPhoneline(phonelineId)) {
+            return unavailablePhonelineRead();
+        }
+        return this.delegate.getPhoneline(userId, phonelineId);
+    }
+    async getPhonelineBlockAnonymous(userId, phonelineId) {
+        this.assertUser(userId);
+        if (this.scope === "user" && !await this.assertOwnedPhoneline(phonelineId)) {
+            return unavailablePhonelineRead();
+        }
+        return this.delegate.getPhonelineBlockAnonymous(userId, phonelineId);
+    }
+    async listPhonelineDevices(userId, phonelineId) {
+        this.assertUser(userId);
+        if (this.scope === "user" && !await this.assertOwnedPhoneline(phonelineId)) {
+            return unavailablePhonelineRead(true);
+        }
+        const response = await this.delegate.listPhonelineDevices(userId, phonelineId);
+        if (this.scope === "account" || asObject(response)?.phonelinesAvailable === false) {
+            return response;
+        }
+        try {
+            const deviceIds = await this.ownedDeviceIds();
+            return {
+                ...asObject(response),
+                items: items(response).filter((device) => {
+                    const deviceId = stringField(device, "id");
+                    return deviceId !== undefined && deviceIds.has(deviceId);
+                }),
+            };
+        }
+        catch {
+            throw new AccessPolicyError("User scope could not establish ownership of the phoneline's attached devices.");
+        }
+    }
+    async listParallelForwardings(userId, phonelineId) {
+        this.assertUser(userId);
+        if (this.scope === "user" && !await this.assertOwnedPhoneline(phonelineId)) {
+            return unavailablePhonelineRead(true);
+        }
+        return this.delegate.listParallelForwardings(userId, phonelineId);
+    }
+    async listPhonelineVoicemails(userId, phonelineId) {
+        this.assertUser(userId);
+        if (this.scope === "user" && !await this.assertOwnedPhoneline(phonelineId)) {
+            return unavailablePhonelineRead(true);
+        }
+        return this.delegate.listPhonelineVoicemails(userId, phonelineId);
+    }
+    async listVoicemailGreetings(userId, phonelineId, voicemailId) {
+        this.assertUser(userId);
+        if (this.scope === "user" && !await this.assertOwnedVoicemail(phonelineId, voicemailId)) {
+            return unavailablePhonelineRead(true);
+        }
+        return this.delegate.listVoicemailGreetings(userId, phonelineId, voicemailId);
+    }
+    async listVoicemails() {
+        if (this.scope === "account")
+            return this.delegate.listVoicemails();
+        const owned = await this.ownedVoicemailState();
+        if (!owned.available)
+            return unavailablePhonelineRead(true);
+        const response = await this.delegate.listVoicemails();
+        return {
+            ...asObject(response),
+            items: items(response).filter((voicemail) => {
+                const voicemailId = stringField(voicemail, "id");
+                return voicemailId !== undefined && owned.ids.has(voicemailId);
+            }),
+        };
+    }
+    async getVoicemail(voicemailId) {
+        if (this.scope === "user" && !await this.assertOwnedVoicemailId(voicemailId)) {
+            return unavailablePhonelineRead();
+        }
+        return this.delegate.getVoicemail(voicemailId);
+    }
+    listAutorecordingGreetings() {
+        if (this.scope === "user") {
+            throw new AccessPolicyError("User scope cannot access the account-wide automated-recording greeting because it has no user ownership relationship. Use administrator account scope.");
+        }
+        return this.delegate.listAutorecordingGreetings();
+    }
+    async getAutorecordingSettings(extension) {
+        if (this.scope === "user")
+            await this.assertOwnedAutorecordingExtension(extension);
+        return this.delegate.getAutorecordingSettings(extension);
+    }
     listDevices(userId, types) {
         if (this.scope === "account")
             return this.delegate.listDevices(userId, types);
         this.assertUser(userId);
         return this.delegate.listDevices(this.context.userId, types);
     }
+    async getDevice(deviceId) {
+        if (this.scope === "user")
+            await this.assertOwnedDevice(deviceId);
+        return this.delegate.getDevice(deviceId);
+    }
+    async getDeviceCallerId(deviceId) {
+        if (this.scope === "user")
+            await this.assertOwnedDevice(deviceId);
+        return this.delegate.getDeviceCallerId(deviceId);
+    }
+    async getDeviceLocalPrefix(deviceId) {
+        if (this.scope === "user")
+            await this.assertOwnedDevice(deviceId);
+        return this.delegate.getDeviceLocalPrefix(deviceId);
+    }
+    async getDeviceTariffAnnouncement(deviceId) {
+        if (this.scope === "user")
+            await this.assertOwnedDevice(deviceId);
+        return this.delegate.getDeviceTariffAnnouncement(deviceId);
+    }
+    async getDeviceSingleRowDisplay(deviceId) {
+        if (this.scope === "user")
+            await this.assertOwnedDevice(deviceId);
+        return this.delegate.getDeviceSingleRowDisplay(deviceId);
+    }
+    async getDeviceContingents(userId, deviceId) {
+        if (this.scope === "user") {
+            this.assertUser(userId);
+            await this.assertOwnedDevice(deviceId);
+        }
+        return this.delegate.getDeviceContingents(userId, deviceId);
+    }
+    async listAddresses() {
+        const response = await this.delegate.listAddresses();
+        if (this.scope === "account")
+            return response;
+        const candidates = items(response);
+        try {
+            const candidateIds = candidates
+                .map((address) => stringOrNumberField(address, "addressId"))
+                .filter((value) => Boolean(value && /^\d+$/.test(value)))
+                .map(Number);
+            const ownedIds = await this.ownedAddressIdsFor(candidateIds);
+            return {
+                items: candidates.filter((address) => {
+                    const value = stringOrNumberField(address, "addressId");
+                    return value !== undefined && ownedIds.has(value);
+                }),
+            };
+        }
+        catch {
+            throw new AccessPolicyError("User scope could not establish ownership of the account's addresses.");
+        }
+    }
+    async getAddress(addressId) {
+        if (this.scope === "user")
+            await this.assertOwnedAddress(addressId);
+        return this.delegate.getAddress(addressId);
+    }
+    async listAddressNumbers(addressId) {
+        if (this.scope === "account")
+            return this.delegate.listAddressNumbers(addressId);
+        await this.assertOwnedAddress(addressId);
+        // An address can be shared with numbers belonging to other users. Ownership
+        // of one number must not expose the rest of them.
+        const numbers = await this.ownedNumbers();
+        const response = await this.delegate.listAddressNumbers(addressId);
+        return {
+            items: items(response).filter((number) => this.isOwnedNumber(number, numbers)),
+        };
+    }
+    validateQuickDialNumber(quickDialNumber) {
+        return this.delegate.validateQuickDialNumber(quickDialNumber);
+    }
+    listContacts(query) {
+        return this.delegate.listContacts(query);
+    }
+    getContact(contactId) {
+        return this.delegate.getContact(contactId);
+    }
+    listInternalContacts() {
+        return this.delegate.listInternalContacts();
+    }
+    exportContactsCsv(scopes) {
+        return this.delegate.exportContactsCsv(scopes);
+    }
+    getContactsVcard(query) {
+        return this.delegate.getContactsVcard(query);
+    }
+    listIncomingBlacklist() {
+        return this.delegate.listIncomingBlacklist();
+    }
+    getCallRestrictions(userIds) {
+        if (this.scope === "account")
+            return this.delegate.getCallRestrictions(userIds);
+        if (userIds) {
+            for (const userId of userIds)
+                this.assertUser(userId);
+        }
+        return this.delegate.getCallRestrictions([this.context.userId]);
+    }
+    getRestrictions(userId, restrictions) {
+        this.assertUser(userId);
+        return this.delegate.getRestrictions(userId, restrictions);
+    }
     getRouting(userId) {
         if (this.scope === "account")
             return this.delegate.getRouting(userId);
@@ -110,20 +359,206 @@ export class AccessControlledBackend {
         }
         return this.delegate.getCallHistory({ ...query, connectionIds: scopedConnectionIds });
     }
+    async exportHistory(query) {
+        if (this.scope === "account")
+            return this.delegate.exportHistory(query);
+        const connectionIds = await this.ownedConnectionIds();
+        const requested = query.connectionIds;
+        if (requested) {
+            for (const connectionId of requested) {
+                this.assertOwned(connectionIds, connectionId, "connection");
+            }
+        }
+        const scopedConnectionIds = requested ?? [...connectionIds];
+        if (scopedConnectionIds.length === 0) {
+            return {
+                content: "",
+                contentType: "text/csv",
+                note: "The authenticated user has no owned connections to export.",
+            };
+        }
+        return this.delegate.exportHistory({ ...query, connectionIds: scopedConnectionIds });
+    }
+    async listCalls() {
+        if (this.scope === "account")
+            return this.delegate.listCalls();
+        try {
+            const [response, deviceIds, numbers] = await Promise.all([
+                this.delegate.listCalls(),
+                this.ownedDeviceIds(),
+                this.ownedNumbers(),
+            ]);
+            return {
+                data: calls(response).filter((call) => this.isOwnedCall(call, deviceIds, numbers)),
+            };
+        }
+        catch (error) {
+            if (error instanceof AccessPolicyError)
+                throw error;
+            throw new AccessPolicyError("User scope could not establish ownership of the account's active calls.");
+        }
+    }
+    listNotifications(userId) {
+        this.assertUser(userId);
+        return this.delegate.listNotifications(userId);
+    }
+    listFaxlines(userId) {
+        this.assertUser(userId);
+        return this.delegate.listFaxlines(userId);
+    }
+    async listFaxlineNumbers(userId, faxlineId) {
+        this.assertUser(userId);
+        if (this.scope === "user")
+            await this.assertOwnedFaxline(faxlineId);
+        return this.delegate.listFaxlineNumbers(userId, faxlineId);
+    }
+    async getFaxlineCallerId(userId, faxlineId) {
+        this.assertUser(userId);
+        if (this.scope === "user")
+            await this.assertOwnedFaxline(faxlineId);
+        return this.delegate.getFaxlineCallerId(userId, faxlineId);
+    }
+    async getHistoryEntry(entryId) {
+        if (this.scope === "user")
+            await this.assertOwnedHistoryEntry(entryId);
+        return this.delegate.getHistoryEntry(entryId);
+    }
     getSettings(userId) {
         if (this.scope === "account")
             return this.delegate.getSettings(userId);
         this.assertUser(userId);
         return this.delegate.getSettings(this.context.userId);
     }
+    getBalance() {
+        return this.delegate.getBalance();
+    }
+    listPortings() {
+        return this.delegate.listPortings();
+    }
+    getPorting(portingId) {
+        return this.delegate.getPorting(portingId);
+    }
+    getSipgateIoSettings() {
+        return this.delegate.getSipgateIoSettings();
+    }
+    listWebhookLogs() {
+        return this.delegate.listWebhookLogs();
+    }
+    createContact(input, confirmAccountWide) {
+        this.assertAccountWideConfirmation(confirmAccountWide, "contact creation");
+        return this.delegate.createContact(input, confirmAccountWide);
+    }
+    updateContact(contactId, input, confirmAccountWide) {
+        this.assertAccountWideConfirmation(confirmAccountWide, "contact update");
+        return this.delegate.updateContact(contactId, input, confirmAccountWide);
+    }
+    deleteContact(contactId, scopes, confirmAccountWide) {
+        this.assertAccountWideConfirmation(confirmAccountWide, "contact deletion");
+        return this.delegate.deleteContact(contactId, scopes, confirmAccountWide);
+    }
+    deleteContacts(input, confirmAccountWide) {
+        this.assertAccountWideConfirmation(confirmAccountWide, "bulk contact deletion");
+        return this.delegate.deleteContacts(input, confirmAccountWide);
+    }
+    importContactsCsv(base64Content, confirmAccountWide) {
+        this.assertAccountWideConfirmation(confirmAccountWide, "CSV contact import");
+        return this.delegate.importContactsCsv(base64Content, confirmAccountWide);
+    }
+    putContactsVcard(scope, data, confirmAccountWide) {
+        this.assertAccountWideConfirmation(confirmAccountWide, "vCard contact update");
+        return this.delegate.putContactsVcard(scope, data, confirmAccountWide);
+    }
+    addIncomingBlacklist(phoneNumber, isBlock, confirmAccountWide) {
+        this.assertAccountWideConfirmation(confirmAccountWide, "incoming blacklist update");
+        return this.delegate.addIncomingBlacklist(phoneNumber, isBlock, confirmAccountWide);
+    }
+    removeIncomingBlacklist(phoneNumber, confirmAccountWide) {
+        this.assertAccountWideConfirmation(confirmAccountWide, "incoming blacklist deletion");
+        return this.delegate.removeIncomingBlacklist(phoneNumber, confirmAccountWide);
+    }
+    setCallRestriction(restriction, enabled) {
+        return this.delegate.setCallRestriction(restriction, enabled);
+    }
+    async setHistoryRead(entryId, value) {
+        if (this.scope === "user")
+            await this.assertOwnedHistoryEntry(entryId);
+        return this.delegate.setHistoryRead(entryId, value);
+    }
+    async setHistoryNote(entryId, note) {
+        if (this.scope === "user")
+            await this.assertOwnedHistoryEntry(entryId);
+        return this.delegate.setHistoryNote(entryId, note);
+    }
+    async setHistoryArchive(entryId, value) {
+        if (this.scope === "user")
+            await this.assertOwnedHistoryEntry(entryId);
+        return this.delegate.setHistoryArchive(entryId, value);
+    }
+    async updateHistoryEntry(entryId, input) {
+        if (this.scope === "user")
+            await this.assertOwnedHistoryEntry(entryId);
+        return this.delegate.updateHistoryEntry(entryId, input);
+    }
+    async deleteHistoryEntry(entryId) {
+        if (this.scope === "user")
+            await this.assertOwnedHistoryEntry(entryId);
+        return this.delegate.deleteHistoryEntry(entryId);
+    }
+    async updateHistoryEntries(inputs) {
+        if (this.scope === "user") {
+            for (const input of inputs)
+                await this.assertOwnedHistoryEntry(input.id);
+        }
+        return this.delegate.updateHistoryEntries(inputs);
+    }
+    async deleteHistoryEntries(entryIds) {
+        if (this.scope === "account")
+            return this.delegate.deleteHistoryEntries(entryIds);
+        if (entryIds) {
+            for (const entryId of entryIds)
+                await this.assertOwnedHistoryEntry(entryId);
+            return this.delegate.deleteHistoryEntries(entryIds);
+        }
+        const ownedEntryIds = await this.ownedHistoryEntryIds();
+        if (ownedEntryIds.length === 0) {
+            return {
+                before: [],
+                after: {
+                    changed: false,
+                    deleted: false,
+                    note: "The authenticated user has no owned history entries to delete; no account-wide request was issued.",
+                },
+            };
+        }
+        return this.delegate.deleteHistoryEntries(ownedEntryIds);
+    }
+    cancelPorting(portingId, confirmAccountWide) {
+        if (confirmAccountWide !== true) {
+            throw new AccessPolicyError("Cancelling a number porting requires confirm_account_wide: true.");
+        }
+        return this.delegate.cancelPorting(portingId, confirmAccountWide);
+    }
+    updateSipgateIoSettings(input, confirmAccountWide) {
+        this.assertAccountWideConfirmation(confirmAccountWide, "sipgate.io account settings update");
+        return this.delegate.updateSipgateIoSettings(input, confirmAccountWide);
+    }
     async setNumberRouting(numberId, endpointId) {
         if (this.scope === "user") {
-            const [numbers, phonelineIds] = await Promise.all([
-                this.ownedNumbers(),
-                this.ownedPhonelineIds(),
-            ]);
-            this.assertOwned(numbers.numberIds, numberId, "phone number");
-            this.assertOwned(phonelineIds, endpointId, "destination phoneline");
+            try {
+                // Accounts without a phoneline layer route numbers straight to a
+                // device, so an owned device is a legitimate destination endpoint.
+                const [numbers, endpointIds] = await Promise.all([
+                    this.ownedNumbers(),
+                    this.ownedConnectionIds(),
+                ]);
+                this.assertOwned(numbers.numberIds, numberId, "phone number");
+                this.assertOwned(endpointIds, endpointId, "destination endpoint");
+            }
+            catch (error) {
+                if (error instanceof AccessPolicyError)
+                    throw error;
+                throw new AccessPolicyError("User scope could not establish ownership of the requested number or destination endpoint.");
+            }
         }
         return this.scope === "user"
             ? this.delegate.setUserNumberRouting(this.context.userId, numberId, endpointId)
@@ -136,16 +571,278 @@ export class AccessControlledBackend {
     async setForwarding(userId, phonelineId, forwardings) {
         if (this.scope === "user") {
             this.assertUser(userId);
-            this.assertOwned(await this.ownedPhonelineIds(), phonelineId, "phoneline");
+            if (!await this.assertOwnedPhoneline(phonelineId))
+                return unavailablePhonelineMutation();
         }
         return this.delegate.setForwarding(userId, phonelineId, forwardings);
     }
-    async setDnd(deviceId, enabled) {
+    createPhoneline(userId) {
+        this.assertUser(userId);
+        return this.delegate.createPhoneline(userId);
+    }
+    async updatePhonelineAlias(userId, phonelineId, alias) {
+        this.assertUser(userId);
+        if (this.scope === "user" && !await this.assertOwnedPhoneline(phonelineId)) {
+            return unavailablePhonelineMutation();
+        }
+        return this.delegate.updatePhonelineAlias(userId, phonelineId, alias);
+    }
+    async deletePhoneline(userId, phonelineId) {
+        this.assertUser(userId);
+        if (this.scope === "user" && !await this.assertOwnedPhoneline(phonelineId)) {
+            return unavailablePhonelineMutation();
+        }
+        return this.delegate.deletePhoneline(userId, phonelineId);
+    }
+    async setPhonelineBlockAnonymous(userId, phonelineId, input) {
+        this.assertUser(userId);
+        if (this.scope === "user" && !await this.assertOwnedPhoneline(phonelineId)) {
+            return unavailablePhonelineMutation();
+        }
+        return this.delegate.setPhonelineBlockAnonymous(userId, phonelineId, input);
+    }
+    async attachDeviceToPhoneline(userId, phonelineId, deviceId) {
+        this.assertUser(userId);
         if (this.scope === "user") {
-            this.assertOwned(await this.ownedDeviceIds(), deviceId, "device");
+            if (!await this.assertOwnedPhoneline(phonelineId))
+                return unavailablePhonelineMutation();
+            await this.assertOwnedDevice(deviceId);
+        }
+        return this.delegate.attachDeviceToPhoneline(userId, phonelineId, deviceId);
+    }
+    async detachDeviceFromPhoneline(userId, phonelineId, deviceId) {
+        this.assertUser(userId);
+        if (this.scope === "user") {
+            if (!await this.assertOwnedPhoneline(phonelineId))
+                return unavailablePhonelineMutation();
+            await this.assertOwnedDevice(deviceId);
+        }
+        return this.delegate.detachDeviceFromPhoneline(userId, phonelineId, deviceId);
+    }
+    async createParallelForwarding(userId, phonelineId, input) {
+        this.assertUser(userId);
+        if (this.scope === "user" && !await this.assertOwnedPhoneline(phonelineId)) {
+            return unavailablePhonelineMutation();
+        }
+        return this.delegate.createParallelForwarding(userId, phonelineId, input);
+    }
+    async updateParallelForwarding(userId, phonelineId, parallelForwardingId, input) {
+        this.assertUser(userId);
+        if (this.scope === "user"
+            && !await this.assertOwnedParallelForwarding(phonelineId, parallelForwardingId))
+            return unavailablePhonelineMutation();
+        return this.delegate.updateParallelForwarding(userId, phonelineId, parallelForwardingId, input);
+    }
+    async deleteParallelForwarding(userId, phonelineId, parallelForwardingId) {
+        this.assertUser(userId);
+        if (this.scope === "user"
+            && !await this.assertOwnedParallelForwarding(phonelineId, parallelForwardingId))
+            return unavailablePhonelineMutation();
+        return this.delegate.deleteParallelForwarding(userId, phonelineId, parallelForwardingId);
+    }
+    async updateVoicemail(userId, phonelineId, voicemailId, input) {
+        this.assertUser(userId);
+        if (this.scope === "user" && !await this.assertOwnedVoicemail(phonelineId, voicemailId)) {
+            return unavailablePhonelineMutation();
+        }
+        return this.delegate.updateVoicemail(userId, phonelineId, voicemailId, input);
+    }
+    async createVoicemailGreeting(userId, phonelineId, voicemailId, input) {
+        this.assertUser(userId);
+        if (this.scope === "user" && !await this.assertOwnedVoicemail(phonelineId, voicemailId)) {
+            return unavailablePhonelineMutation();
+        }
+        return this.delegate.createVoicemailGreeting(userId, phonelineId, voicemailId, input);
+    }
+    async updateVoicemailGreeting(userId, phonelineId, voicemailId, greetingId, active) {
+        this.assertUser(userId);
+        if (this.scope === "user"
+            && !await this.assertOwnedGreeting(phonelineId, voicemailId, greetingId))
+            return unavailablePhonelineMutation();
+        return this.delegate.updateVoicemailGreeting(userId, phonelineId, voicemailId, greetingId, active);
+    }
+    async deleteVoicemailGreeting(userId, phonelineId, voicemailId, greetingId) {
+        this.assertUser(userId);
+        if (this.scope === "user"
+            && !await this.assertOwnedGreeting(phonelineId, voicemailId, greetingId))
+            return unavailablePhonelineMutation();
+        return this.delegate.deleteVoicemailGreeting(userId, phonelineId, voicemailId, greetingId);
+    }
+    async setVoicemailTranscription(userId, phonelineId, voicemailId, active) {
+        this.assertUser(userId);
+        if (this.scope === "user" && !await this.assertOwnedVoicemail(phonelineId, voicemailId)) {
+            return unavailablePhonelineMutation();
+        }
+        return this.delegate.setVoicemailTranscription(userId, phonelineId, voicemailId, active);
+    }
+    async playVoicemail(input) {
+        if (this.scope === "user") {
+            if (!input.deviceId || !input.dataId) {
+                throw new AccessPolicyError("User scope requires both device and voicemail-data IDs to establish playback ownership.");
+            }
+            await this.assertOwnedDevice(input.deviceId);
+            await this.assertOwnedHistoryEntry(input.dataId);
+        }
+        return this.delegate.playVoicemail(input);
+    }
+    async recordVoicemailGreeting(input) {
+        if (this.scope === "user") {
+            if (!input.deviceId || !input.targetId) {
+                throw new AccessPolicyError("User scope requires both device and target voicemail IDs to establish recording ownership.");
+            }
+            await this.assertOwnedDevice(input.deviceId);
+            if (!await this.assertOwnedVoicemailId(input.targetId))
+                return unavailablePhonelineMutation();
+        }
+        return this.delegate.recordVoicemailGreeting(input);
+    }
+    createAutorecordingGreeting(input) {
+        if (this.scope === "user") {
+            throw new AccessPolicyError("User scope cannot change the account-wide automated-recording greeting because it has no user ownership relationship. Use administrator account scope.");
+        }
+        return this.delegate.createAutorecordingGreeting(input);
+    }
+    async deleteAutorecordingGreeting(greetingId) {
+        if (this.scope === "user") {
+            throw new AccessPolicyError("User scope cannot delete the account-wide automated-recording greeting because it has no user ownership relationship. Use administrator account scope.");
+        }
+        return this.delegate.deleteAutorecordingGreeting(greetingId);
+    }
+    async setAutorecordingSettings(extension, active) {
+        if (this.scope === "user")
+            await this.assertOwnedAutorecordingExtension(extension);
+        return this.delegate.setAutorecordingSettings(extension, active);
+    }
+    createFaxline(userId) {
+        this.assertUser(userId);
+        return this.delegate.createFaxline(userId);
+    }
+    async updateFaxlineAlias(userId, faxlineId, alias) {
+        this.assertUser(userId);
+        if (this.scope === "user")
+            await this.assertOwnedFaxline(faxlineId);
+        return this.delegate.updateFaxlineAlias(userId, faxlineId, alias);
+    }
+    async deleteFaxline(userId, faxlineId) {
+        this.assertUser(userId);
+        if (this.scope === "user")
+            await this.assertOwnedFaxline(faxlineId);
+        return this.delegate.deleteFaxline(userId, faxlineId);
+    }
+    async setFaxlineCallerId(userId, faxlineId, value) {
+        this.assertUser(userId);
+        if (this.scope === "user") {
+            await this.assertOwnedFaxline(faxlineId);
+            if (value)
+                await this.assertOwnedPhoneNumber(value, "fax caller ID phone number");
         }
+        return this.delegate.setFaxlineCallerId(userId, faxlineId, value);
+    }
+    async setFaxlineTagline(userId, faxlineId, value) {
+        this.assertUser(userId);
+        if (this.scope === "user")
+            await this.assertOwnedFaxline(faxlineId);
+        return this.delegate.setFaxlineTagline(userId, faxlineId, value);
+    }
+    async setDnd(deviceId, enabled) {
+        if (this.scope === "user")
+            await this.assertOwnedDevice(deviceId);
         return this.delegate.setDnd(deviceId, enabled);
     }
+    async updateDevice(deviceId, settings) {
+        if (this.scope === "user") {
+            await this.assertOwnedDevice(deviceId);
+            if (settings.emergencyAddressId !== undefined) {
+                await this.assertOwnedAddress(settings.emergencyAddressId);
+            }
+        }
+        return this.delegate.updateDevice(deviceId, settings);
+    }
+    async deleteDevice(deviceId) {
+        if (this.scope === "user")
+            await this.assertOwnedDevice(deviceId);
+        return this.delegate.deleteDevice(deviceId);
+    }
+    async setDeviceAlias(deviceId, value) {
+        if (this.scope === "user")
+            await this.assertOwnedDevice(deviceId);
+        return this.delegate.setDeviceAlias(deviceId, value);
+    }
+    async setDeviceCallerId(deviceId, value) {
+        if (this.scope === "user") {
+            await this.assertOwnedDevice(deviceId);
+            if (value !== undefined) {
+                await this.assertOwnedPhoneNumber(value, "caller ID phone number");
+            }
+        }
+        return this.delegate.setDeviceCallerId(deviceId, value);
+    }
+    async setDeviceLocalPrefix(deviceId, input) {
+        if (this.scope === "user")
+            await this.assertOwnedDevice(deviceId);
+        return this.delegate.setDeviceLocalPrefix(deviceId, input);
+    }
+    async setDeviceTariffAnnouncement(deviceId, enabled) {
+        if (this.scope === "user")
+            await this.assertOwnedDevice(deviceId);
+        return this.delegate.setDeviceTariffAnnouncement(deviceId, enabled);
+    }
+    async setDeviceSingleRowDisplay(deviceId, enabled) {
+        if (this.scope === "user")
+            await this.assertOwnedDevice(deviceId);
+        return this.delegate.setDeviceSingleRowDisplay(deviceId, enabled);
+    }
+    async setExternalDeviceTargetNumber(deviceId, number) {
+        if (this.scope === "user")
+            await this.assertOwnedDevice(deviceId);
+        return this.delegate.setExternalDeviceTargetNumber(deviceId, number);
+    }
+    async setExternalDeviceIncomingCallDisplay(deviceId, incomingCallDisplay) {
+        if (this.scope === "user")
+            await this.assertOwnedDevice(deviceId);
+        return this.delegate.setExternalDeviceIncomingCallDisplay(deviceId, incomingCallDisplay);
+    }
+    async changeDevicePassword(deviceId) {
+        if (this.scope === "user")
+            await this.assertOwnedDevice(deviceId);
+        return this.delegate.changeDevicePassword(deviceId);
+    }
+    createRegisterDevice(userId, alias) {
+        this.assertUser(userId);
+        return this.delegate.createRegisterDevice(userId, alias);
+    }
+    createMobileDevice(userId, alias) {
+        this.assertUser(userId);
+        return this.delegate.createMobileDevice(userId, alias);
+    }
+    createExternalDevice(userId, alias, number) {
+        this.assertUser(userId);
+        return this.delegate.createExternalDevice(userId, alias, number);
+    }
+    createQuickDial(input) {
+        this.assertUser(input.userId);
+        return this.delegate.createQuickDial(input);
+    }
+    async updateQuickDial(quickDialId, input) {
+        if (this.scope === "user") {
+            this.assertUser(input.userId);
+            await this.assertOwnedNumberId(quickDialId, "quick-dial number");
+        }
+        return this.delegate.updateQuickDial(quickDialId, input);
+    }
+    async deleteQuickDial(numberId) {
+        if (this.scope === "user") {
+            await this.assertOwnedNumberId(numberId, "quick-dial number");
+        }
+        return this.delegate.deleteQuickDial(numberId);
+    }
+    async updateAddress(addressId, input) {
+        if (this.scope === "user") {
+            await this.assertOwnedAddress(addressId);
+            await this.assertExclusivelyOwnedAddress(addressId);
+        }
+        return this.delegate.updateAddress(addressId, input);
+    }
     async sendSms(input) {
         if (this.scope === "user")
             this.assertUser(input.userId);
@@ -153,19 +850,26 @@ export class AccessControlledBackend {
     }
     async initiateCall(input) {
         if (this.scope === "user") {
-            const [numbers, deviceIds] = await Promise.all([
-                this.ownedNumbers(),
-                this.ownedDeviceIds(),
-            ]);
-            const callerIsOwned = deviceIds.has(input.caller)
-                || numbers.phoneNumbers.has(input.caller);
-            if (!callerIsOwned) {
-                throw new AccessPolicyError("User scope only permits calls from the authenticated user's devices or phone numbers.");
+            try {
+                const [numbers, deviceIds] = await Promise.all([
+                    this.ownedNumbers(),
+                    this.ownedDeviceIds(),
+                ]);
+                const callerIsOwned = deviceIds.has(input.caller)
+                    || numbers.phoneNumbers.has(input.caller);
+                if (!callerIsOwned) {
+                    throw new AccessPolicyError("User scope only permits calls from the authenticated user's devices or phone numbers.");
+                }
+                if (input.deviceId)
+                    this.assertOwned(deviceIds, input.deviceId, "device");
+                if (input.callerId)
+                    this.assertOwned(numbers.phoneNumbers, input.callerId, "caller ID");
+            }
+            catch (error) {
+                if (error instanceof AccessPolicyError)
+                    throw error;
+                throw new AccessPolicyError("User scope could not establish ownership of the requested call origin.");
             }
-            if (input.deviceId)
-                this.assertOwned(deviceIds, input.deviceId, "device");
-            if (input.callerId)
-                this.assertOwned(numbers.phoneNumbers, input.callerId, "caller ID");
         }
         return this.scope === "user"
             ? this.delegate.initiateUserCall(input)
@@ -176,6 +880,186 @@ export class AccessControlledBackend {
             return this.delegate.initiateUserCall(input);
         return this.initiateCall(input);
     }
+    async createCallEmailNotification(input) {
+        this.assertUser(input.userId);
+        if (this.scope === "user")
+            await this.assertOwnedConnectionId(input.endpointId);
+        return this.delegate.createCallEmailNotification(input);
+    }
+    async createCallSmsNotification(input) {
+        this.assertUser(input.userId);
+        if (this.scope === "user")
+            await this.assertOwnedConnectionId(input.endpointId);
+        return this.delegate.createCallSmsNotification(input);
+    }
+    async createFaxEmailNotification(input) {
+        this.assertUser(input.userId);
+        if (this.scope === "user")
+            await this.assertOwnedFaxline(input.faxlineId);
+        return this.delegate.createFaxEmailNotification(input);
+    }
+    async createFaxSmsNotification(input) {
+        this.assertUser(input.userId);
+        if (this.scope === "user")
+            await this.assertOwnedFaxline(input.faxlineId);
+        return this.delegate.createFaxSmsNotification(input);
+    }
+    async createFaxReportNotification(input) {
+        this.assertUser(input.userId);
+        if (this.scope === "user")
+            await this.assertOwnedFaxline(input.faxlineId);
+        return this.delegate.createFaxReportNotification(input);
+    }
+    createSmsEmailNotification(input) {
+        this.assertUser(input.userId);
+        return this.delegate.createSmsEmailNotification(input);
+    }
+    async createVoicemailEmailNotification(input) {
+        this.assertUser(input.userId);
+        if (this.scope === "user" && !await this.assertOwnedVoicemailId(input.voicemailId)) {
+            return unavailablePhonelineMutation();
+        }
+        return this.delegate.createVoicemailEmailNotification(input);
+    }
+    async createVoicemailSmsNotification(input) {
+        this.assertUser(input.userId);
+        if (this.scope === "user" && !await this.assertOwnedVoicemailId(input.voicemailId)) {
+            return unavailablePhonelineMutation();
+        }
+        return this.delegate.createVoicemailSmsNotification(input);
+    }
+    async deleteNotification(userId, notificationId) {
+        this.assertUser(userId);
+        if (this.scope === "user") {
+            try {
+                const ownedIds = nestedNotificationIds(await this.delegate.listNotifications(userId));
+                this.assertOwned(ownedIds, notificationId, "notification");
+            }
+            catch (error) {
+                if (error instanceof AccessPolicyError)
+                    throw error;
+                throw new AccessPolicyError("User scope could not establish ownership of the requested notification.");
+            }
+        }
+        return this.delegate.deleteNotification(userId, notificationId);
+    }
+    async hangupCall(callId) {
+        if (this.scope === "user")
+            await this.assertOwnedCall(callId);
+        return this.delegate.hangupCall(callId);
+    }
+    async setCallHold(callId, value) {
+        if (this.scope === "user")
+            await this.assertOwnedCall(callId);
+        return this.delegate.setCallHold(callId, value);
+    }
+    async setCallMuted(callId, value) {
+        if (this.scope === "user")
+            await this.assertOwnedCall(callId);
+        return this.delegate.setCallMuted(callId, value);
+    }
+    async setCallRecording(callId, value, announcement) {
+        if (this.scope === "user")
+            await this.assertOwnedCall(callId);
+        return this.delegate.setCallRecording(callId, value, announcement);
+    }
+    async transferCall(callId, input) {
+        if (this.scope === "user") {
+            await this.assertOwnedCall(callId);
+            if (input.callerId !== undefined) {
+                await this.assertOwnedPhoneNumber(input.callerId, "transfer caller ID phone number");
+            }
+        }
+        return this.delegate.transferCall(callId, input);
+    }
+    async sendCallDtmf(callId, sequence) {
+        if (this.scope === "user")
+            await this.assertOwnedCall(callId);
+        return this.delegate.sendCallDtmf(callId, sequence);
+    }
+    async startCallAnnouncement(callId, url) {
+        if (this.scope === "user")
+            await this.assertOwnedCall(callId);
+        return this.delegate.startCallAnnouncement(callId, url);
+    }
+    async sendFax(input) {
+        if (this.scope === "user")
+            await this.assertOwnedFaxline(input.faxlineId);
+        return this.delegate.sendFax(input);
+    }
+    async resendFax(input) {
+        if (this.scope === "user") {
+            if (!input.faxlineId) {
+                throw new AccessPolicyError("User scope requires a faxline ID to establish ownership before resending a fax.");
+            }
+            await this.assertOwnedFaxline(input.faxlineId);
+            await this.assertOwnedHistoryEntry(input.faxId);
+        }
+        return this.delegate.resendFax(input);
+    }
+    /**
+     * A fax ID is a history entry. Resending one that belongs to another user
+     * would retransmit their document and bill it, so the entry's connection must
+     * be one the authenticated user owns.
+     */
+    async assertOwnedHistoryEntry(entryId) {
+        let connectionIds;
+        let entry;
+        try {
+            [connectionIds, entry] = await Promise.all([
+                this.ownedConnectionIds(),
+                this.delegate.getHistoryEntry(entryId).then((value) => asObject(value)),
+            ]);
+        }
+        catch {
+            throw new AccessPolicyError("User scope could not establish ownership of the requested history entry.");
+        }
+        const entryConnections = Array.isArray(entry?.connectionIds)
+            ? entry.connectionIds.filter((value) => typeof value === "string")
+            : [];
+        if (entryConnections.some((connectionId) => connectionIds.has(connectionId)))
+            return;
+        throw new AccessPolicyError("User scope does not permit access to the requested history entry.");
+    }
+    assertAccountWideConfirmation(confirmAccountWide, operation) {
+        if (this.scope === "account" || confirmAccountWide === true)
+            return;
+        throw new AccessPolicyError(`User scope requires confirm_account_wide: true for this account-wide ${operation}.`);
+    }
+    async ownedHistoryEntryIds() {
+        try {
+            const connectionIds = [...await this.ownedConnectionIds()];
+            if (connectionIds.length === 0)
+                return [];
+            const found = new Set();
+            const pageSize = 1000;
+            for (const archived of [false, true]) {
+                for (let offset = 0;; offset += pageSize) {
+                    const response = await this.delegate.getCallHistory({
+                        archived,
+                        connectionIds,
+                        limit: pageSize,
+                        offset,
+                        types: ["CALL", "VOICEMAIL", "SMS", "FAX"],
+                    });
+                    const page = items(response);
+                    for (const entry of page) {
+                        const entryId = stringField(entry, "id");
+                        if (entryId)
+                            found.add(entryId);
+                    }
+                    if (page.length < pageSize)
+                        break;
+                }
+            }
+            return [...found];
+        }
+        catch (error) {
+            if (error instanceof AccessPolicyError)
+                throw error;
+            throw new AccessPolicyError("User scope could not enumerate owned history entries for bulk deletion.");
+        }
+    }
     assertUser(userId) {
         if (this.scope === "account" || userId === undefined || userId === this.context.userId)
             return;
@@ -193,24 +1077,328 @@ export class AccessControlledBackend {
         ]);
         return new Set([...phonelineIds, ...deviceIds]);
     }
+    async assertOwnedConnectionId(connectionId) {
+        try {
+            this.assertOwned(await this.ownedConnectionIds(), connectionId, "notification endpoint");
+        }
+        catch (error) {
+            if (error instanceof AccessPolicyError)
+                throw error;
+            throw new AccessPolicyError("User scope could not establish ownership of the requested notification endpoint.");
+        }
+    }
+    async assertOwnedFaxline(faxlineId) {
+        try {
+            this.assertOwned(await this.ownedFaxlineIds(), faxlineId, "faxline");
+        }
+        catch (error) {
+            if (error instanceof AccessPolicyError)
+                throw error;
+            throw new AccessPolicyError("User scope could not establish ownership of the requested faxline.");
+        }
+    }
+    async assertOwnedCall(callId) {
+        try {
+            const [response, deviceIds, numbers] = await Promise.all([
+                this.delegate.listCalls(),
+                this.ownedDeviceIds(),
+                this.ownedNumbers(),
+            ]);
+            const call = calls(response).find((candidate) => stringField(candidate, "callId") === callId);
+            if (call && this.isOwnedCall(call, deviceIds, numbers))
+                return;
+            throw new AccessPolicyError("User scope does not permit access to the requested active call.");
+        }
+        catch (error) {
+            if (error instanceof AccessPolicyError)
+                throw error;
+            throw new AccessPolicyError("User scope could not establish ownership of the requested active call.");
+        }
+    }
+    isOwnedCall(call, deviceIds, numbers) {
+        // Being a participant in someone else's call is not ownership: the remote
+        // party of a foreign call carries an owned number too. Only the participant
+        // sipgate marks as the call owner counts, and an unmarked call fails closed.
+        const owner = objectArray(call.participants)
+            .find((participant) => participant.owner === true);
+        if (!owner)
+            return false;
+        const participantId = stringField(owner, "participantId");
+        const phoneNumber = stringField(owner, "phoneNumber");
+        return (participantId !== undefined && deviceIds.has(participantId))
+            || (phoneNumber !== undefined && numbers.phoneNumbers.has(phoneNumber));
+    }
     async ownedPhonelineIds() {
+        return (await this.ownedPhonelineState()).ids;
+    }
+    async ownedPhonelineState() {
         const phonelinesResponse = await this.delegate.listPhonelines(this.context.userId);
-        return new Set(items(phonelinesResponse)
-            .map((phoneline) => stringField(phoneline, "id"))
+        return {
+            available: asObject(phonelinesResponse)?.phonelinesAvailable !== false,
+            ids: new Set(items(phonelinesResponse)
+                .map((phoneline) => stringField(phoneline, "id"))
+                .filter((id) => Boolean(id))),
+        };
+    }
+    async assertOwnedPhoneline(phonelineId) {
+        try {
+            const owned = await this.ownedPhonelineState();
+            if (!owned.available)
+                return false;
+            this.assertOwned(owned.ids, phonelineId, "phoneline");
+            return true;
+        }
+        catch (error) {
+            if (error instanceof AccessPolicyError)
+                throw error;
+            throw new AccessPolicyError("User scope could not establish ownership of the requested phoneline.");
+        }
+    }
+    async assertOwnedParallelForwarding(phonelineId, parallelForwardingId) {
+        if (!await this.assertOwnedPhoneline(phonelineId))
+            return false;
+        try {
+            const response = await this.delegate.listParallelForwardings(this.context.userId, phonelineId);
+            if (asObject(response)?.phonelinesAvailable === false)
+                return false;
+            const ids = new Set(items(response)
+                .map((forwarding) => stringField(forwarding, "id"))
+                .filter((id) => Boolean(id)));
+            this.assertOwned(ids, parallelForwardingId, "parallel forwarding");
+            return true;
+        }
+        catch (error) {
+            if (error instanceof AccessPolicyError)
+                throw error;
+            throw new AccessPolicyError("User scope could not establish ownership of the requested parallel forwarding.");
+        }
+    }
+    async assertOwnedVoicemail(phonelineId, voicemailId) {
+        if (!await this.assertOwnedPhoneline(phonelineId))
+            return false;
+        try {
+            const response = await this.delegate.listPhonelineVoicemails(this.context.userId, phonelineId);
+            if (asObject(response)?.phonelinesAvailable === false)
+                return false;
+            const ids = new Set(items(response)
+                .map((voicemail) => stringField(voicemail, "id"))
+                .filter((id) => Boolean(id)));
+            this.assertOwned(ids, voicemailId, "voicemail");
+            return true;
+        }
+        catch (error) {
+            if (error instanceof AccessPolicyError)
+                throw error;
+            throw new AccessPolicyError("User scope could not establish ownership of the requested voicemail.");
+        }
+    }
+    async ownedVoicemailState() {
+        try {
+            const phonelines = await this.ownedPhonelineState();
+            if (!phonelines.available)
+                return { available: false, ids: new Set() };
+            const responses = await Promise.all([...phonelines.ids].map((phonelineId) => this.delegate.listPhonelineVoicemails(this.context.userId, phonelineId)));
+            if (responses.some((response) => asObject(response)?.phonelinesAvailable === false)) {
+                return { available: false, ids: new Set() };
+            }
+            return {
+                available: true,
+                ids: new Set(responses.flatMap((response) => items(response)
+                    .map((voicemail) => stringField(voicemail, "id"))
+                    .filter((id) => Boolean(id)))),
+            };
+        }
+        catch {
+            throw new AccessPolicyError("User scope could not establish ownership of the requested voicemail.");
+        }
+    }
+    async assertOwnedVoicemailId(voicemailId) {
+        const owned = await this.ownedVoicemailState();
+        if (!owned.available)
+            return false;
+        this.assertOwned(owned.ids, voicemailId, "voicemail");
+        return true;
+    }
+    async assertOwnedGreeting(phonelineId, voicemailId, greetingId) {
+        if (!await this.assertOwnedVoicemail(phonelineId, voicemailId))
+            return false;
+        try {
+            const response = await this.delegate.listVoicemailGreetings(this.context.userId, phonelineId, voicemailId);
+            if (asObject(response)?.phonelinesAvailable === false)
+                return false;
+            const ids = new Set(items(response)
+                .map((greeting) => stringField(greeting, "id"))
+                .filter((id) => Boolean(id)));
+            this.assertOwned(ids, greetingId, "voicemail greeting");
+            return true;
+        }
+        catch (error) {
+            if (error instanceof AccessPolicyError)
+                throw error;
+            throw new AccessPolicyError("User scope could not establish ownership of the requested voicemail greeting.");
+        }
+    }
+    async ownedFaxlineIds() {
+        const response = await this.delegate.listFaxlines(this.context.userId);
+        return new Set(items(response)
+            .map((faxline) => stringField(faxline, "id"))
             .filter((id) => Boolean(id)));
     }
+    async assertOwnedAutorecordingExtension(extension) {
+        try {
+            // sipgate documents automated recording for register endpoints, so an
+            // owned device is the primary case; phonelines and faxlines are accepted
+            // for accounts that expose them.
+            const [phonelines, faxlineIds, deviceIds] = await Promise.all([
+                this.ownedPhonelineState(),
+                this.ownedFaxlineIds(),
+                this.ownedDeviceIds(),
+            ]);
+            if (deviceIds.has(extension) || phonelines.ids.has(extension) || faxlineIds.has(extension))
+                return;
+            throw new AccessPolicyError("User scope does not permit access to the requested automated-recording extension.");
+        }
+        catch (error) {
+            if (error instanceof AccessPolicyError)
+                throw error;
+            throw new AccessPolicyError("User scope could not establish ownership of the requested automated-recording extension.");
+        }
+    }
     async ownedDeviceIds() {
         const devicesResponse = await this.delegate.listDevices(this.context.userId);
         return new Set(items(devicesResponse)
             .map((device) => stringField(device, "id"))
             .filter((id) => Boolean(id)));
     }
+    async assertOwnedDevice(deviceId) {
+        try {
+            this.assertOwned(await this.ownedDeviceIds(), deviceId, "device");
+        }
+        catch (error) {
+            if (error instanceof AccessPolicyError)
+                throw error;
+            throw new AccessPolicyError("User scope could not establish ownership of the requested device.");
+        }
+    }
+    async assertOwnedNumberId(numberId, resource) {
+        try {
+            this.assertOwned((await this.ownedNumbers()).numberIds, numberId, resource);
+        }
+        catch (error) {
+            if (error instanceof AccessPolicyError)
+                throw error;
+            throw new AccessPolicyError(`User scope could not establish ownership of the requested ${resource}.`);
+        }
+    }
+    async assertOwnedPhoneNumber(phoneNumber, resource) {
+        try {
+            this.assertOwned((await this.ownedNumbers()).phoneNumbers, phoneNumber, resource);
+        }
+        catch (error) {
+            if (error instanceof AccessPolicyError)
+                throw error;
+            throw new AccessPolicyError(`User scope could not establish ownership of the requested ${resource}.`);
+        }
+    }
+    async assertOwnedAddress(addressId) {
+        try {
+            if (await this.isOwnedAddress(addressId))
+                return;
+        }
+        catch {
+            // Ownership lookup failures are deliberately exposed as policy denials.
+        }
+        throw new AccessPolicyError("User scope does not permit access to the requested address because ownership could not be established.");
+    }
+    async isOwnedAddress(addressId) {
+        return (await this.ownedAddressIdsFor([addressId])).has(String(addressId));
+    }
+    async ownedAddressIdsFor(addressIdsToCheck) {
+        if (addressIdsToCheck.length === 0)
+            return new Set();
+        const expected = new Set(addressIdsToCheck.map(String));
+        const [numbers, devicesResponse] = await Promise.all([
+            this.ownedNumbers(),
+            this.delegate.listDevices(this.context.userId),
+        ]);
+        const owned = new Set([...numbers.addressIds].filter((addressId) => expected.has(addressId)));
+        const devices = items(devicesResponse);
+        for (const device of devices) {
+            for (const addressId of addressIds(device)) {
+                if (expected.has(addressId))
+                    owned.add(addressId);
+            }
+        }
+        const detailedDevices = await Promise.allSettled(devices.map(async (device) => {
+            const deviceId = stringField(device, "id");
+            return deviceId ? this.delegate.getDevice(deviceId) : undefined;
+        }));
+        for (const result of detailedDevices) {
+            if (result.status !== "fulfilled")
+                continue;
+            const device = asObject(result.value);
+            if (!device)
+                continue;
+            for (const addressId of addressIds(device)) {
+                if (expected.has(addressId))
+                    owned.add(addressId);
+            }
+        }
+        const unresolved = addressIdsToCheck.filter((addressId) => !owned.has(String(addressId)));
+        const addressNumberResponses = await Promise.all(unresolved.map(async (addressId) => ({
+            addressId: String(addressId),
+            response: await this.delegate.listAddressNumbers(addressId),
+        })));
+        for (const { addressId, response } of addressNumberResponses) {
+            const containsOwnedNumber = items(response).some((number) => {
+                const numberId = stringField(number, "id");
+                const phoneNumber = stringField(number, "number");
+                return (numberId !== undefined && numbers.numberIds.has(numberId))
+                    || (phoneNumber !== undefined && numbers.phoneNumbers.has(phoneNumber));
+            });
+            if (containsOwnedNumber)
+                owned.add(addressId);
+        }
+        return owned;
+    }
+    isOwnedNumber(number, numbers) {
+        const numberId = stringField(number, "id");
+        const phoneNumber = stringField(number, "number");
+        return (numberId !== undefined && numbers.numberIds.has(numberId))
+            || (phoneNumber !== undefined && numbers.phoneNumbers.has(phoneNumber));
+    }
+    /**
+     * Editing an address rewrites it for every number attached to it, so a
+     * user-scope write is only safe when the user owns all of them.
+     */
+    async assertExclusivelyOwnedAddress(addressId) {
+        const [numbers, response] = await Promise.all([
+            this.ownedNumbers(),
+            this.delegate.listAddressNumbers(addressId),
+        ]);
+        const attached = items(response);
+        const foreign = attached.filter((number) => !this.isOwnedNumber(number, numbers));
+        if (foreign.length === 0)
+            return;
+        throw new AccessPolicyError("User scope does not permit editing an address that is shared with numbers of other users.");
+    }
     async ownedNumbers() {
-        const numbersResponse = await this.delegate.listUserNumbers(this.context.userId, { offset: 0, limit: 1000 });
-        const numbers = items(numbersResponse);
+        const pageSize = 1000;
+        const routed = [];
+        for (let offset = 0;; offset += pageSize) {
+            const page = items(await this.delegate.listUserNumbers(this.context.userId, { offset, limit: pageSize }));
+            routed.push(...page);
+            if (page.length < pageSize)
+                break;
+        }
+        // Quick dials and other number types are listed by the direct user-number
+        // endpoint but may never appear in phoneline or device routing.
+        const direct = items(await this.delegate.getUserNumbers(this.context.userId));
+        const numbers = [...routed, ...direct];
         return {
             numberIds: new Set(numbers.map((number) => stringField(number, "id")).filter((id) => Boolean(id))),
             phoneNumbers: new Set(numbers.map((number) => stringField(number, "number")).filter((number) => Boolean(number))),
+            addressIds: new Set(numbers.flatMap((number) => addressIds(number))),
         };
     }
 }