[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_192":193,"_194":195},"routes/_app.x.$handle.$name",{"_97":96,"_31":42,"_106":87,"_26":107,"_13":14,"_108":-5,"_11":109,"_110":111,"_112":113,"_114":115,"_116":117,"_20":-5,"_118":-5,"_119":-5,"_120":24,"_121":122,"_123":56,"_124":-5,"_125":-5,"_126":127},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_40":41,"_31":42,"_35":43,"_44":-5,"_45":24,"_46":47,"_48":47,"_49":50,"_51":-5,"_18":52,"_53":54,"_55":56,"_57":-5,"_58":-5,"_59":60,"_61":62,"_63":64,"_65":66,"_67":68,"_69":-5,"_70":71,"_72":71,"_73":74,"_75":74,"_76":74,"_77":71,"_78":71,"_79":80,"_81":82,"_83":84,"_85":24},"version",5,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":-7,"_23":24,"_25":24,"_26":27,"_28":27},"file",{"_29":30,"_31":27,"_32":20,"_33":34,"_35":36,"_37":14,"_38":39,"_23":24},"previous","deleted",false,"deletedHere","path","flow-outbound.html","latestPath","fileId","747ecd56-854d-11f1-a638-1607ee4eb77e","name","fileType","content","\n\n\n\n\nPOST /call — Outbound Call E2E Flow\n\n\n\n\n\nCALLS · FLOWCHART\n

POST /call — Outbound Call E2E Flow

Full lifecycle of an outbound phone call: HTTP entry → initialization → transport routing (two paths) → carrier dial → callWorker pipeline → call end. Latency-bearing steps are flagged.

\n\n\n

01HTTP Entryapps/api

\n call.controller.ts:91 — CallController.create()\n

\n • Auth + CASL scope check (ACTION_AUTH.CREATE, SUBJECT_AUTH.CALL)\n • If dto.type === 'outboundPhoneCall' → fires async Dodgeball fraud tracking event\n • If dto.transport.provider === 'websocket' → diverges to callService.websocketCallCreate()\n • Otherwise → callService.createPhoneCall()\n

↓

\n call.service.ts:201 — createPhoneCall()\n

\n • dto.customers (batch) → callBatch() → different path (fan-out)\n • dto.schedulePlan → callSchedule() (writes scheduled row, no immediate dial)\n • Otherwise → callOutbound() ← the normal path\n

\n\n

callOutbound()↓

\n\n\n

02Call InitializationphoneCallFunctions.ts:276

\n 1\n

Pre-load org + feature flags db read

callOrgGet() / featureFlagGet(). Validates billing (concurrency limits, subscription). Returns 400 here if over limit — no DB write yet.

\n 2\n

Resolve assistant version db read

assistantVersionForCallDispatch(). Handles assistantId, inline assistant, squadId/squad, workflowId/workflow, or pinned assistantVersionId. Error → 400 before any call row is written.

\n 3\n

Write call row to DB db write

callInitialize(). Inserts call with status: 'queued'. From this point a call record exists.

\n 4\n

Fetch resources multiple db reads

callResourcesGet(): full assistant (tools, credentials), phone number, customer record, all credentials. Missing → callEndOnError() + error.

\n 5\n

Guard checks each failure marks call ended

\n • Free Vapi number → international → call.start.error-vapi-number-international\n • Dodgeball fraud check (ENABLE_OUTBOUND_CALL_FRAUD_CHECK + Vapi number)\n • Daily outbound limit (resets if outboundCallsCounterNextResetAt passed)\n

\n\n

↓

\n\n\n

03Transport Routingtwo paths

Branch

ENABLE_OUTBOUND_CALL_QUEUING feature flag?

Path A · Queuing ON

\n pendingOutboundCallEnqueue() pushes the call into a Redis/Valkey pending queue. API returns immediately with the queued call. A separate callScheduler worker dequeues and calls callOutboundTransportAndQueue() when capacity is available.

Backpressure valve — prevents thundering-herd on carrier APIs.\n

Path B · Direct (flag off)

\n callOutboundTransportAndQueue() is called inline from the API request, adding its latency directly to the HTTP response. Also taken when phoneCallProviderBypassEnabled.

This is why POST /call sometimes takes >5s — the carrier API is hit synchronously.\n

\n\n

both converge on callOutboundTransportAndQueue()↓

\n\n\n

04Transport + QueuephoneCallFunctions.ts:132

\n callTransportGet() — carrier dial latency 1–5s+\n

Contacts Twilio / Telnyx / Vonage to actually dial the phone — creates the PSTN leg. TwiML/SIP URI streams audio back to Vapi's WebSocket server. Primary latency source on Path B.
• Error → callTransportErrorHandle() + Kafka callOutboundInitiatedEventEmit(status: 'failure')

↓

\n liveCallRequired()\n

Constructs the LiveCall object, stamping all resolved resources (org, assistant, phone number, customer, credentials, feature flags) onto the call.

↓

\n callStoreAndQueue()\n

Updates the call row (transport info, phone provider ID, increments concurrency counter) and enqueues a BullMQ job to the CALL queue for the callWorker.

↓

\n Kafka + API response\n

• Kafka callOutboundInitiatedEventEmit(status: 'success')• API returns the call object (status: queued) — the call.status === 'queued' webhook fires here.

\n\n

BullMQ CALL queue↓

\n\n\n

05callWorker — Live Pipelineapps/callWorker

\n streamBundleConstruct.ts → streamBundleConnectPipes.ts\n

BullMQ picks up the job and creates the LiveCallPipeline. The stream pipeline is constructed, then wired:

Carrier WebSocket audio in ↓

VadStreamvoice activity detection

DenoiserStreamoptional

BackgroundSpeechFilteroptional

CombinedAudioBufferrecording mix

SttStreamDeepgram / AssemblyAI / …

ConversationBuffermessage history

EndpointingBufferend-of-turn detection

LlmStreamOpenAI / Anthropic / …

TtsStreamElevenLabs / Cartesia / …

SampleRateConverter

TurnTakingBuffer

VolumeControlBufferbot speaking state, audio mixing

TransportStream→ carrier WebSocket audio out

↓

\n callStart()\n

All streams start corked (buffering). callStart() uncorks them, fires the assistant-request → assistant-response webhook sequence (server-URL-based configs), then fires status-update: in-progress.

\n\n

on end condition: silence / maxDuration / endCall / hangup↓

\n\n\n

06Call Endmanager.end()

manager.end()

Waits ~2.5s for final STT transcripts to drain.

Cost collection (bottom-up)

STT (per min per channel), LLM (per token), TTS (per character). BYOK credentials (org provides key) → marked user-fault, not billed to subscription.

streamBundleArtifacts()

Uploads recording WAV + transcript JSON to S3.

callComplete()

Writes final DB state: endedAt, endedReason, costs, artifact URLs, analysis (structuredData + successEvaluation + summary from the analysis plan).

end-of-call-report webhook

Delivered to your server URL.

\n\n\n

Key latency sources on POST /call

\n \n \n \n \n \n \n \n \n \n \n

Source	When it hits
callOrgGet + featureFlagGet	always DB reads
assistantVersionForCallDispatch	always DB read
callInitialize	always DB write
callResourcesGet	always multiple DB reads (assistant + phone number + credentials)
Dodgeball fraud check	conditional Vapi numbers only, flag-gated
callTransportGet (carrier API)	path B only biggest variable, 1–5s+ (queuing flag off)

\n If queuing (ENABLE_OUTBOUND_CALL_QUEUING) is on for your org, the carrier dial is deferred and the API returns fast. On the standard path it's all synchronous — which explains the >5s responses seen in the earlier investigation.\n

\n\n\n\n\n\n","createdAt",["D",1784670313854],"branchVersion","branchId","51319357-762a-49a7-b659-2d021fe3500c","id","e9627797-35b4-470a-a957-8eeef849cbac","vapi-knowledge-base",["D",1784597836214],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Collaborative Vapi platform reference","imageUrl","28056148-fc13-432f-be05-37a4ce07f9db","pinnedFileId","b47707a6-84a4-11f1-bf51-1607ee4eb77e","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","019e511e-6214-7719-8b29-0af034f4b069","tursoName","e962779735b4470aa9578eeef849cbac","tursoHostname","e962779735b4470aa9578eeef849cbac-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789474853273],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_97":96,"_105":101},"org",{"_97":96,"_98":99,"_100":101,"_18":52,"_102":103,"_104":24},"branch",{"_13":86,"_31":87,"_40":39,"_88":41,"_89":-5,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":42,"_95":96},"isOwned",11,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","prudhvinakkina","handle","displayName","Prudhvi Nakkina","avatar","https://lh3.googleusercontent.com/a/ACg8ocJhop25jm0wt-QSQjfGck498ZYGdD4MCM_ARgX-IyZCNlNiRl8=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_40":41,"_31":42,"_35":187,"_44":-5,"_45":24,"_46":47,"_48":47,"_49":50,"_51":-5,"_18":52,"_53":54,"_55":56,"_57":-5,"_58":-5,"_59":60,"_61":62,"_63":64,"_65":66,"_67":188,"_69":-5,"_70":71,"_72":71,"_73":74,"_75":74,"_76":74,"_77":71,"_78":71,"_79":189,"_81":190,"_83":191,"_85":24},"tree",[170,171,172,173],"files",[170,171,172,173],"counts",{"_160":60,"_161":138,"_162":60,"_163":164,"_165":166},"contents",[128,129,130,131],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_40":157,"_31":27,"_29":30,"_134":-5,"_38":39,"_37":14,"_136":56,"_35":158,"_13":60,"_32":20,"_33":34,"_23":24,"_141":-5,"_26":159},{"_40":150,"_31":151,"_29":152,"_134":-5,"_38":39,"_37":153,"_136":24,"_35":154,"_13":60,"_32":20,"_33":155,"_23":24,"_141":-5,"_26":156},{"_40":143,"_31":144,"_29":145,"_134":-5,"_38":39,"_37":146,"_136":56,"_35":147,"_13":60,"_32":20,"_33":148,"_23":24,"_141":-5,"_26":149},{"_40":132,"_31":133,"_29":54,"_134":-5,"_38":39,"_37":135,"_136":24,"_35":137,"_13":138,"_32":139,"_33":140,"_23":24,"_141":-5,"_26":142},"2b490a7a-f6ba-42e8-bf9f-4028709e67bf","main.tsx","parentId",4,"latest",["D",1784598028360],1,"http","import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { readFile } from \"https://esm.town/v/std/utils/index.ts\";\nimport { createHmac, timingSafeEqual } from \"node:crypto\";\nimport { Buffer } from \"node:buffer\";\n\nconst PASSCODE = Deno.env.get(\"KB_PASSCODE\") || \"\";\nconst VALID_SECTIONS = [\"calls\", \"assistants\", \"infra\", \"guardrails\", \"compliance\"];\nconst SOURCE_URL = \"https://www.val.town/x/prudhvinakkina/vapi-knowledge-base\";\n\nconst SEED: Array<{ section: string; title: string; body: string; source?: string; tags?: string }> = [\n // ── CALLS ──\n {\n section: \"calls\",\n title: \"POST /call is the unified endpoint — use it\",\n body: \"`POST /call` is the single active endpoint. It handles outbound + websocket transport via `dto.type`.\\n\\n• `POST /call` — **ACTIVE**, private/org-jwt. Use this.\\n• `POST /call/phone` — **DEPRECATED**, calls the same service method, no functional difference. Migrate to `/call`.\\n• `POST /call/web` — **ACTIVE**, public/org-jwt. Web calls only, uses `TokenRestrictionsGuard`, CASL subject `webCall`.\\n• `POST /call/phone/demo` — **INTERNAL**, `@ApiExcludeEndpoint()`, demo use only.\",\n source: \"apps/api/src/call/call.controller.ts:91 (POST /call), :261 (POST /call/phone)\",\n tags: \"endpoints, deprecation, routing\",\n },\n {\n section: \"calls\",\n title: \"Call latency root cause: Aurora DB, not Twilio\",\n body: \"When `ENABLE_OUTBOUND_CALL_QUEUING` is on, the Twilio dial is fully async (handed to call-scheduler-v2 before the HTTP response). **Aurora is the blocker.**\\n\\n• Aurora INSERT baseline ~200ms, spikes to ~3s under load.\\n• Pre-INSERT sequential reads also spike — observed 2.7s vs 226ms on a healthy call.\",\n source: \"libs/core/src/dbFunctions/callDbFunctions.ts\",\n tags: \"latency, aurora, performance\",\n },\n {\n section: \"calls\",\n title: \"Recommended client timeout for POST /call: 15 seconds\",\n body: \"The old 5s timeout was too tight — it fires before Aurora recovers from a spike. **15s** gives headroom for Aurora peaks while still catching genuine hangs.\",\n tags: \"latency, timeout, recommendation\",\n },\n {\n section: \"calls\",\n title: \"Two call-creation paths: queuing vs direct\",\n body: \"**Path A · Queuing (most orgs), `ENABLE_OUTBOUND_CALL_QUEUING=on`:**\\n• DB INSERT → Twilio dial enqueued to call-scheduler-v2 (async) → HTTP response returns after INSERT.\\n• Response time = DB time only; Twilio latency is invisible to the caller.\\n\\n**Path B · Direct (flag off):**\\n• DB INSERT → Twilio dial synchronously → response after both complete.\\n• Response time = DB + Twilio round-trip. Higher latency, less common.\",\n tags: \"architecture, queuing\",\n },\n {\n section: \"calls\",\n title: \"Axiom: dataset is logs-production; app timestamps live in the message field\",\n body: \"Correct dataset name is `logs-production` (not `otel.traces`, not `vapi-logs-prod`). Use `listDatasets` to confirm if it changes.\\n\\nAxiom's ingestion timestamp is when the log arrived, not when the event happened. Real timestamps are emoji-prefixed inside the message field: `🕐 14:23:05:142` (HH:MM:SS:mmm). Query by `callId`.\",\n tags: \"axiom, logs, observability\",\n },\n\n // ── ASSISTANTS ──\n {\n section: \"assistants\",\n title: \"endCall: three separate systems\",\n body: \"**endCall tool** (recommended): explicit tool in `model.tools[]` with `type: \\\"endCall\\\"`. The LLM decides when to fire. On fire it speaks the request-start message (→ `endCallMessage` → i18n \\\"Goodbye\\\"), then ends.\\n\\n**endCallMessage**: text spoken when the endCall tool fires if no tool `messages[]` are set. Falls back to i18n \\\"Goodbye\\\". Set it as the fallback.\\n\\n**endCallPhrases**: real-time bot-transcript watcher, no LLM. Substring-matches the bot transcript; on match it mutes the user, waits for the bot to finish, waits 500ms, then ends with reason `assistant-said-end-call-phrase`. Good safety net.\\n\\n**endCallFunctionEnabled** (deprecated): auto-injects an implicit endCall tool. Replace with an explicit `model.tools[]` entry.\",\n source: \"libs/core/src/util/toolUtil/endCallToolUtil.ts · liveCallPipeline.ts:2577\",\n tags: \"endcall, tools\",\n },\n {\n section: \"assistants\",\n title: \"endCall message resolution order\",\n body: \"tool's own `messages[].content` → `assistant.endCallMessage` → i18n(\\\"Goodbye\\\", transcriber language). Implemented in `endCallMessagesRequired()`.\",\n source: \"libs/core/src/util/toolUtil/endCallToolUtil.ts\",\n tags: \"endcall\",\n },\n {\n section: \"assistants\",\n title: \"Voicemail Path A: provider-side detection\",\n body: \"The provider (Twilio/Telnyx) signals voicemail; `VoicemailDetectionStream` catches it; `liveCallManager.speakVoicemailAndEnd()` runs:\\n• If `voicemailMessage` is set → speaks it, ends with reason `voicemail`.\\n• If not set → ends immediately as `customer-did-not-answer`.\\n\\nNo LLM involved. Controlled by the `voicemailDetection` object. Set `provider` to `google` or `openai` for model-based detection.\",\n source: \"libs/core/src/components/liveCallManager.ts:1050\",\n tags: \"voicemail, detection\",\n },\n {\n section: \"assistants\",\n title: \"Voicemail Path B: LLM tool\",\n body: \"Explicit tool with `type: \\\"voicemail\\\"` in `model.tools[]`. The LLM decides when to invoke it. It has its own `messages[]`; falls back to `voicemailMessage` if empty. Extra field `beepDetectionEnabled` (Twilio-only). Unlike endCall, the voicemail tool is **not** auto-injected — add it explicitly.\",\n tags: \"voicemail, tools\",\n },\n {\n section: \"assistants\",\n title: \"Recommended endCall config\",\n body: \"1. Add `{ type: \\\"endCall\\\" }` to `model.tools[]`.\\n2. Set `endCallMessage` as the spoken goodbye.\\n3. Set `endCallPhrases` (e.g. `[\\\"goodbye\\\", \\\"take care\\\"]`) as a safety net.\\n\\nDo **not** use `endCallFunctionEnabled: true`.\",\n tags: \"recommendation, endcall\",\n },\n {\n section: \"assistants\",\n title: \"Recommended voicemail config\",\n body: \"1. Set `voicemailDetection` with your provider plan.\\n2. Set `voicemailMessage` (what to say on voicemail).\\n3. Optionally add `{ type: \\\"voicemail\\\" }` tool if LLM detection is needed.\\n\\nIf `voicemailMessage` is unset and voicemail is detected, the call silently hangs up as `customer-did-not-answer`.\",\n tags: \"recommendation, voicemail\",\n },\n\n // ── INFRA ──\n {\n section: \"infra\",\n title: \"Voice stream pipeline chain\",\n body: \"VadStream → DenoiserStream? → SttStream → ConversationBuffer → EndpointingBuffer → LlmStream → TtsStream → TurnTakingBuffer → VolumeControlBuffer → TransportStream.\\n\\nParallel: HookStream · Recorder · VoicemailDetectionStream (outbound only).\",\n source: \"libs/core/src/functions/liveCallFunctions/streamBundleConnectPipes.ts\",\n tags: \"pipeline, streams\",\n },\n {\n section: \"infra\",\n title: \"StreamModule cork/uncork backpressure\",\n body: \"All streams start **corked** — buffering input, not processing. Call `stream.ready()` to uncork and flush. Forgetting `ready()` causes silent buffering with no errors. Every subclass implements `process()`, `clear()`, `cleanup()`, `costGet()`.\",\n source: \"libs/core/src/components/streamModule.ts\",\n tags: \"streams, backpressure\",\n },\n {\n section: \"infra\",\n title: \"Three processing modes\",\n body: \"**Cascaded** (default): LLM → TTS. Most providers.\\n**Speech-to-speech**: OpenAI Realtime / Google Live. Direct audio stream, no separate TTS.\\n**Workflow**: WorkflowStream replaces the LLM for workflow-driven calls.\\n\\nSet in `streamBundleConnectPipes.ts` phase 2.\",\n tags: \"pipeline, modes\",\n },\n {\n section: \"infra\",\n title: \"Worker + queue architecture\",\n body: \"• **CALL queue** → callWorker (port 3030): real-time voice, creates LiveCallManager → LiveCallPipeline per call.\\n• **admin queue** → adminWorker: billing, status updates, post-call ops.\\n• **pendingOutbound queue** → callScheduler (call-scheduler-v2): outbound backpressure when `ENABLE_OUTBOUND_CALL_QUEUING` is on.\\n• **Kafka pipeline.ended** → postCallConsumer (port 3031): artifacts, cost rollup.\\n• **Kafka call lifecycle** → callLifecycleConsumer (port 3032): status change events.\\n\\nQueues are BullMQ on Redis.\",\n tags: \"workers, queues, kafka\",\n },\n {\n section: \"infra\",\n title: \"24+ databases, one PostgreSQL DB per domain\",\n body: \"`assistantDb` · `callDb` · `paymentDb` · `credentialDb` · `authorizationDb` · `campaignDb` · `chatDb` · `sessionDb` · `phoneNumberDb` · `voiceLibraryDb` · `testSuiteDb` · `customerDb` · `idempotencyDb` · `logsDb` + replicas.\\n\\nEach is an Aurora PostgreSQL cluster — independent scaling, separate HIPAA/PCI scope.\",\n tags: \"database, architecture\",\n },\n {\n section: \"infra\",\n title: \"Internal observability tooling\",\n body: \"• BullMQ queue browser (Bullish UI): `http://localhost:3005`\\n• Internal call inspector: `http://localhost:3018/calls/{callId}`\\n• Pipeline latency: `streamBundleLogLatency` tracks all stages.\",\n tags: \"observability, tooling\",\n },\n\n // ── GUARDRAILS ──\n {\n section: \"guardrails\",\n title: \"endCallPhrases: real-time phrase detection\",\n body: \"On each bot transcript update, checks whether the bot's last message (lowercased) contains any phrase from `endCallPhrases[]` (case-insensitive substring match). On match: mutes the user, waits for the bot to finish speaking, waits 500ms, then ends with reason `assistant-said-end-call-phrase`. No LLM involved — runs entirely in the pipeline. A good safety net for when the LLM fails to call the endCall tool.\",\n source: \"libs/core/src/components/liveCallPipeline/liveCallPipeline.ts:2577\",\n tags: \"endcall, safety\",\n },\n {\n section: \"guardrails\",\n title: \"rejectionPlan on tools\",\n body: \"Tools inherit `messages[]` and `rejectionPlan` from `ToolUserEditableBase`. `rejectionPlan` controls what the assistant does when a tool call is rejected or blocked. Configure it alongside the tool definition in `model.tools[]`.\",\n tags: \"tools, safety\",\n },\n\n // ── COMPLIANCE ──\n {\n section: \"compliance\",\n title: \"Data isolation: DB-per-domain, HIPAA & PCI scope\",\n body: \"Vapi runs 24+ separate PostgreSQL databases, one per domain (see INFRA). Each is an independent Aurora cluster, which means **separate HIPAA/PCI scope** per domain. Payment data lives in `paymentDb`, credentials in `credentialDb`, isolated from call/assistant data — independent scaling and blast-radius containment.\",\n tags: \"hipaa, pci, isolation\",\n },\n];\n\nlet readyPromise: Promise | null = null;\nfunction ensureInit(): Promise {\n if (!readyPromise) readyPromise = init();\n return readyPromise;\n}\nasync function init(): Promise {\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS kb_entries (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n section TEXT NOT NULL,\n title TEXT NOT NULL,\n body TEXT NOT NULL,\n source TEXT,\n tags TEXT,\n author TEXT,\n created_at TEXT NOT NULL DEFAULT (datetime('now'))\n )`);\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS kb_meta (k TEXT PRIMARY KEY, v TEXT)`);\n const seeded = await sqlite.execute(`SELECT v FROM kb_meta WHERE k = 'seeded'`);\n if (seeded.rows.length === 0) {\n for (const e of SEED) {\n await sqlite.execute({\n sql: `INSERT INTO kb_entries (section, title, body, source, tags, author) VALUES (?, ?, ?, ?, ?, 'seed')`,\n args: [e.section, e.title, e.body, e.source ?? null, e.tags ?? null],\n });\n }\n await sqlite.execute({ sql: `INSERT INTO kb_meta (k, v) VALUES ('seeded', '1')`, args: [] });\n }\n}\n\nfunction sessionToken(): string {\n return createHmac(\"sha256\", PASSCODE || \"unset\").update(\"kb-session-v1\").digest(\"hex\");\n}\nfunction safeEqual(a: string, b: string): boolean {\n const ab = Buffer.from(a);\n const bb = Buffer.from(b);\n return ab.length === bb.length && timingSafeEqual(ab, bb);\n}\nfunction isAuthed(req: Request): boolean {\n if (!PASSCODE) return false;\n const cookie = req.headers.get(\"cookie\") || \"\";\n const m = cookie.match(/(?:^|;\\s*)kb_auth=([a-f0-9]+)/);\n return !!m && safeEqual(m[1], sessionToken());\n}\nfunction json(data: unknown, status = 200, headers: Record = {}): Response {\n return new Response(JSON.stringify(data), {\n status,\n headers: { \"content-type\": \"application/json\", ...headers },\n });\n}\n\nexport default async function (req: Request): Promise {\n await ensureInit();\n const url = new URL(req.url);\n const p = url.pathname;\n\n if (p === \"/source\") {\n return new Response(null, { status: 302, headers: { Location: SOURCE_URL } });\n }\n\n // Auth: exchange passcode for a session cookie\n if (p === \"/auth\" && req.method === \"POST\") {\n let body: any = {};\n try { body = await req.json(); } catch { /* ignore */ }\n const supplied = String(body?.passcode ?? \"\");\n if (!PASSCODE || !safeEqual(supplied, PASSCODE)) {\n return json({ error: \"Invalid passcode\" }, 401);\n }\n return json({ ok: true }, 200, {\n \"set-cookie\": `kb_auth=${sessionToken()}; HttpOnly; Path=/; Max-Age=7776000; SameSite=Lax`,\n });\n }\n\n const authed = isAuthed(req);\n\n // API (all gated)\n if (p.startsWith(\"/api/\")) {\n if (!authed) return json({ error: \"unauthorized\" }, 401);\n\n if (p === \"/api/entries\" && req.method === \"GET\") {\n const r = await sqlite.execute(`SELECT * FROM kb_entries ORDER BY created_at DESC, id DESC`);\n return json({ entries: r.rows });\n }\n\n if (p === \"/api/entries\" && req.method === \"POST\") {\n let b: any = {};\n try { b = await req.json(); } catch { /* ignore */ }\n const section = String(b?.section ?? \"\").trim();\n const title = String(b?.title ?? \"\").trim();\n const bodyText = String(b?.body ?? \"\").trim();\n if (!VALID_SECTIONS.includes(section)) return json({ error: \"invalid section\" }, 400);\n if (!title || !bodyText) return json({ error: \"title and details are required\" }, 400);\n const source = b?.source ? String(b.source).trim().slice(0, 500) : null;\n const tags = b?.tags ? String(b.tags).trim().slice(0, 300) : null;\n const author = b?.author ? String(b.author).trim().slice(0, 80) : null;\n const ins = await sqlite.execute({\n sql: `INSERT INTO kb_entries (section, title, body, source, tags, author) VALUES (?, ?, ?, ?, ?, ?)`,\n args: [section, title.slice(0, 300), bodyText.slice(0, 8000), source, tags, author],\n });\n const row = await sqlite.execute({\n sql: `SELECT * FROM kb_entries WHERE id = ?`,\n args: [Number(ins.lastInsertRowid)],\n });\n return json({ entry: row.rows[0] }, 201);\n }\n\n const del = p.match(/^\\/api\\/entries\\/(\\d+)$/);\n if (del && req.method === \"DELETE\") {\n await sqlite.execute({ sql: `DELETE FROM kb_entries WHERE id = ?`, args: [Number(del[1])] });\n return json({ ok: true });\n }\n\n return json({ error: \"not found\" }, 404);\n }\n\n // Pages\n if (p === \"/\" || p === \"\") {\n const file = authed ? \"/index.html\" : \"/login.html\";\n const html = await readFile(file, import.meta.url);\n return new Response(html, { headers: { \"content-type\": \"text/html; charset=utf-8\" } });\n }\n\n return new Response(\"Not found\", { status: 404 });\n}\n","label",[133],"bddd7e9f-740d-4c35-beed-11b70ed7c295","login.html","c2687f98-84a4-11f1-8de2-1607ee4eb77e",2,["D",1784597859612],"\n\n\n\n\nVapi Knowledge Base\n\n\n\n

\n \n

\n\n\n\n\n",[144],"8c6adec9-25dd-4b6f-a926-b8386cc54f48","index.html","006a8192-84a5-11f1-9543-1607ee4eb77e",3,["D",1784597963653],"\n\n\n\n\nVapi Platform Knowledge Base\n\n\n\n

\n \n

\n\n

\n \n

\n\n\n\n\n\n",[151],"84d23682-4313-4237-948e-82b7e5dbec0a",["D",1784670313854],[27],"pulls","branches","forks","envVars",{"_167":138,"_169":60},"connections",{"_167":60,"_168":60},"count","unfilledCount","emptyCount",{"_40":157,"_31":27,"_29":30,"_134":-5,"_38":39,"_37":14,"_136":56,"_35":184,"_13":60,"_32":20,"_33":34,"_23":24,"_141":-5,"_175":185,"_26":186},{"_40":150,"_31":151,"_29":152,"_134":-5,"_38":39,"_37":153,"_136":24,"_35":181,"_13":60,"_32":20,"_33":155,"_23":24,"_141":-5,"_175":182,"_26":183},{"_40":143,"_31":144,"_29":145,"_134":-5,"_38":39,"_37":146,"_136":56,"_35":178,"_13":60,"_32":20,"_33":148,"_23":24,"_141":-5,"_175":179,"_26":180},{"_40":132,"_31":133,"_29":54,"_134":-5,"_38":39,"_37":135,"_136":24,"_35":174,"_13":138,"_32":139,"_33":140,"_23":24,"_141":-5,"_175":176,"_26":177},["D",1784598028360],"children",[],[133],["D",1784597859612],[],[144],["D",1784597963653],[],[151],["D",1784670313854],[],[27],["D",1784597836214],["D",1789474853273],{"_97":96,"_105":101},{"_97":96,"_98":99,"_100":101,"_18":52,"_102":103,"_104":24},{"_13":86,"_31":87,"_40":39,"_88":41,"_89":-5,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":42,"_95":96},"ctx",{"_79":-5,"_125":225,"_226":227,"_228":229,"_230":24,"_231":24,"_232":24,"_233":56,"_234":-5,"_235":-7,"_236":-7,"_237":60,"_238":24,"_239":24,"_240":-5,"_241":24,"_242":24,"_243":24,"_244":-5},"ENV",{"_196":197,"_198":199,"_200":87,"_201":202,"_203":204,"_205":206,"_207":208,"_209":210,"_211":212,"_213":214,"_215":216,"_217":218,"_219":220,"_221":222,"_223":224},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

POST /call — Outbound Call E2E Flow

Add knowledge

Diff · v5