flowchart LR
    A[Patient Calls] --> B[Twilio Number]
    B --> C[VAPI Assistant]
    C --> D[Function: Check Availability]
    D --> E[Your Server /webhook]
    E --> F[Dental Practice DB]
    F --> E
    E --> D
    D --> C
    C --> G[Function: Book Appointment]
    G --> E
    E --> F
    F --> E
    E --> G
    G --> C
    C --> H[Confirmation to Patient]

const assistantConfig = {
  model: {
    provider: "openai",
    model: "gpt-4",
    temperature: 0.3, // Low temp = consistent scheduling behavior
    messages: [{
      role: "system",
      content: "You are a dental office receptionist. Collect: patient name, phone, preferred date/time, reason for visit. Confirm insurance status. Be warm but efficient—average call should be under 3 minutes."
    }]
  },
  voice: {
    provider: "11labs",
    voiceId: "rachel", // Professional, clear voice for medical context
    stability: 0.8,
    similarityBoost: 0.75
  },
  transcriber: {
    provider: "deepgram",
    model: "nova-2",
    language: "en-US",
    keywords: ["dentist", "appointment", "cleaning", "extraction", "insurance"] // Boost medical term accuracy
  },
  firstMessage: "Hi, this is Sarah from Bright Smile Dental. How can I help you today?",
  endCallMessage: "Your appointment is confirmed. We'll send a text reminder 24 hours before. Have a great day!",
  endCallFunctionEnabled: true,
  recordingEnabled: true, // HIPAA compliance requirement
  hipaaEnabled: true // Critical for healthcare
};

const serverConfig = {
  serverUrl: process.env.WEBHOOK_URL, // Your ngrok/production URL
  serverUrlSecret: process.env.VAPI_SERVER_SECRET, // Validate webhook signatures
  events: [
    "function-call", // When assistant needs to check availability or book
    "end-of-call-report", // Post-call analytics
    "transcript" // Real-time conversation logging
  ]
};

const express = require('express');
const crypto = require('crypto');
const app = express();

app.use(express.json());

// Validate VAPI webhook signature (security is not optional)
function validateSignature(req) {
  const signature = req.headers['x-vapi-signature'];
  const body = JSON.stringify(req.body);
  const hash = crypto
    .createHmac('sha256', process.env.VAPI_SERVER_SECRET)
    .update(body)
    .digest('hex');
  return signature === hash;
}

app.post('/webhook/vapi', async (req, res) => { // YOUR server endpoint
  if (!validateSignature(req)) {
    return res.status(401).json({ error: 'Invalid signature' });
  }

  const { message } = req.body;

  // Handle function calls from assistant
  if (message.type === 'function-call') {
    const { functionCall } = message;
    
    if (functionCall.name === 'checkAvailability') {
      const { date, time } = functionCall.parameters;
      
      // Query your dental practice database
      const slots = await db.query(
        'SELECT * FROM appointments WHERE date = $1 AND time = $2 AND status = $3',
        [date, time, 'available']
      );
      
      return res.json({
        result: {
          available: slots.length > 0,
          alternativeTimes: slots.length === 0 ? await getNextAvailable(date) : []
        }
      });
    }
    
    if (functionCall.name === 'bookAppointment') {
      const { patientName, phone, date, time, reason } = functionCall.parameters;
      
      try {
        // Race condition guard: check slot still available
        const locked = await db.query(
          'UPDATE appointments SET status = $1 WHERE date = $2 AND time = $3 AND status = $4 RETURNING id',
          ['locked', date, time, 'available']
        );
        
        if (locked.rows.length === 0) {
          return res.json({
            result: { success: false, error: 'Slot no longer available' }
          });
        }
        
        // Insert patient record
        await db.query(
          'INSERT INTO patients (name, phone, appointment_date, appointment_time, reason) VALUES ($1, $2, $3, $4, $5)',
          [patientName, phone, date, time, reason]
        );
        
        // Send SMS confirmation via Twilio
        await fetch('https://api.twilio.com/2010-04-01/Accounts/' + process.env.TWILIO_ACCOUNT_SID + '/Messages.json', {
          method: 'POST',
          headers: {
            'Authorization': 'Basic ' + Buffer.from(process.env.TWILIO_ACCOUNT_SID + ':' + process.env.TWILIO_AUTH_TOKEN).toString('base64'),
            'Content-Type': 'application/x-www-form-urlencoded'
          },
          body: new URLSearchParams({
            To: phone,
            From: process.env.TWILIO_PHONE_NUMBER,
            Body: `Appointment confirmed: ${date} at ${time}. Reply CANCEL to reschedule.`
          })
        });
        
        return res.json({
          result: { success: true, confirmationId: locked.rows[0].id }
        });
      } catch (error) {
        console.error('Booking error:', error);
        return res.json({
          result: { success: false, error: 'Database error. Please call back.' }
        });
      }
    }
  }
  
  res.json({ received: true });
});

app.listen(3000);

assistantConfig.functions = [
  {
    name: "checkAvailability",
    description: "Check if a specific date/time slot is available",
    parameters: {
      type: "object",
      properties: {
        date: { type: "string", description: "YYYY-MM-DD format" },
        time: { type: "string", description: "HH:MM format (24-hour)" }
      },
      required: ["date", "time"]
    }
  },
  {
    name: "bookAppointment",
    description: "Book an appointment after confirming availability",
    parameters: {
      type: "object",
      properties: {
        patientName: { type: "string" },
        phone: { type: "string", pattern: "^\\+?[1-9]\\d{1,14}$" },
        date: { type: "string" },
        time: { type: "string" },
        reason: { type: "string", enum: ["cleaning", "checkup", "emergency", "followup"] }
      },
      required: ["patientName", "phone", "date", "time", "reason"]
    }
  }
];

graph LR
    A[Phone Call Initiation]
    B[Audio Input]
    C[Audio Preprocessing]
    D[Voice Activity Detection]
    E[Speech-to-Text]
    F[Intent Recognition]
    G[Response Generation]
    H[Text-to-Speech]
    I[Audio Output]
    J[Error Handling]
    K[Fallback Mechanism]

    A-->B
    B-->C
    C-->D
    D-->E
    E-->F
    F-->G
    G-->H
    H-->I

    E-->|Error in STT|J
    F-->|Unrecognized Intent|K
    J-->K
    K-->G

// Start ngrok tunnel (run in terminal)
// ngrok http 3000

// Update serverConfig with ngrok URL
const serverConfig = {
  serverUrl: "https://abc123.ngrok.io/webhook/vapi", // Your ngrok URL
  serverUrlSecret: process.env.VAPI_SERVER_SECRET
};

// Test webhook signature validation locally
const testPayload = {
  message: { type: "function-call", functionCall: { name: "bookAppointment" } }
};
const testSignature = crypto
  .createHmac('sha256', process.env.VAPI_SERVER_SECRET)
  .update(JSON.stringify(testPayload))
  .digest('hex');

console.log('Test signature:', testSignature);
// Verify validateSignature() returns true with this signature

if (body.message.type === 'end-of-call-report') {
  // Release all locks for this call's booked slots
  Object.keys(locked).forEach(slot => {
    if (locked[slot] === body.call.id) delete locked[slot];
  });
}

// Handle interruption mid-sentence with buffer flush
app.post('/webhook/vapi', async (req, res) => {
  const event = req.body;
  
  if (event.type === 'speech-update') {
    // Partial transcript detected - user is speaking
    if (event.status === 'started' && event.role === 'user') {
      // Cancel any queued TTS immediately
      await fetch('https://api.vapi.ai/call/' + event.call.id + '/say', {
        method: 'DELETE',
        headers: {
          'Authorization': 'Bearer ' + process.env.VAPI_API_KEY
        }
      });
      
      // Clear server-side audio buffer
      if (locked[event.call.id]) {
        locked[event.call.id] = false; // Release turn lock
      }
    }
  }
  
  res.status(200).send();
});

{
  "timestamp": "2024-01-15T14:32:18.450Z",
  "type": "speech-update",
  "status": "started",
  "role": "user",
  "transcript": "Actually, I need",
  "call": { "id": "call_abc123" }
}

{
  "timestamp": "2024-01-15T14:32:18.650Z",
  "type": "transcript",
  "role": "user",
  "transcript": "Actually, I need it for next Tuesday",
  "transcriptType": "partial"
}

// BROKEN: Race condition allows double-booking
app.post('/webhook/vapi', async (req, res) => {
  const { functionCall } = req.body.message;
  
  if (functionCall.name === 'scheduleAppointment') {
    const { date, time } = functionCall.parameters;
    
    // ❌ Gap between check and lock = race condition
    const isAvailable = await checkSlot(date, time); // 150ms query
    if (isAvailable) {
      await bookSlot(date, time); // 100ms write - TOO LATE
      return res.json({ result: { success: true } });
    }
  }
});

// ✅ FIX: Atomic lock with database constraint
app.post('/webhook/vapi', async (req, res) => {
  const { functionCall } = req.body.message;
  
  if (functionCall.name === 'scheduleAppointment') {
    const { date, time, patientName } = functionCall.parameters;
    
    try {
      // Single atomic operation with UNIQUE constraint on (date, time)
      const result = await db.query(
        'INSERT INTO appointments (date, time, patient) VALUES ($1, $2, $3) ON CONFLICT DO NOTHING RETURNING id',
        [date, time, patientName]
      );
      
      if (result.rowCount === 0) {
        return res.json({ 
          result: { 
            error: 'Slot just taken. Next available: 2:30 PM' 
          } 
        });
      }
      
      return res.json({ result: { success: true, id: result.rows[0].id } });
    } catch (error) {
      return res.json({ result: { error: 'Booking failed. Try again.' } });
    }
  }
});

// ✅ FIX: Capture raw body BEFORE middleware
app.post('/webhook/vapi', 
  express.raw({ type: 'application/json' }), // Preserve raw buffer
  (req, res) => {
    const signature = req.headers['x-vapi-signature'];
    const rawBody = req.body.toString('utf8'); // Use raw buffer
    
    const hash = crypto
      .createHmac('sha256', process.env.VAPI_SERVER_SECRET)
      .update(rawBody)
      .digest('hex');
    
    if (hash !== signature) {
      return res.status(401).json({ error: 'Invalid signature' });
    }
    
    const body = JSON.parse(rawBody); // Parse AFTER validation
    // Process body.message.functionCall...
  }
);

const express = require('express');
const crypto = require('crypto');
const app = express();

// Store booked slots and prevent race conditions
const slots = new Map(); // date-time -> { patientName, phone, reason }
const locked = new Set(); // Track slots being processed

// Raw body for signature validation
app.use(express.json({
  verify: (req, res, buf) => {
    req.rawBody = buf.toString('utf8');
  }
}));

// Validate VAPI webhook signatures
function validateSignature(body, signature, secret) {
  const hash = crypto
    .createHmac('sha256', secret)
    .update(body)
    .digest('hex');
  return hash === signature;
}

// VAPI webhook handler
app.post('/webhook/vapi', async (req, res) => {
  const signature = req.headers['x-vapi-signature'];
  const isValid = validateSignature(
    req.rawBody,
    signature,
    process.env.VAPI_SERVER_SECRET
  );
  
  if (!isValid) {
    return res.status(401).json({ error: 'Invalid signature' });
  }

  const event = req.body;

  // Handle function calls from assistant
  if (event.message?.type === 'function-call') {
    const { functionCall } = event.message;
    
    if (functionCall.name === 'checkAvailability') {
      const { date, time } = functionCall.parameters;
      const slotKey = `${date}T${time}`;
      
      // Check if slot exists and not locked
      const isAvailable = !slots.has(slotKey) && !locked.has(slotKey);
      
      return res.json({
        result: {
          available: isAvailable,
          message: isAvailable 
            ? `${time} on ${date} is available`
            : `${time} on ${date} is already booked`
        }
      });
    }
    
    if (functionCall.name === 'bookAppointment') {
      const { date, time, patientName, phone, reason } = functionCall.parameters;
      const slotKey = `${date}T${time}`;
      
      // Race condition guard
      if (locked.has(slotKey) || slots.has(slotKey)) {
        return res.json({
          result: {
            success: false,
            message: 'Slot no longer available'
          }
        });
      }
      
      // Lock slot during processing
      locked.add(slotKey);
      
      try {
        // Simulate external booking system call
        await new Promise(resolve => setTimeout(resolve, 100));
        
        // Book the slot
        slots.set(slotKey, { patientName, phone, reason });
        
        return res.json({
          result: {
            success: true,
            message: `Appointment confirmed for ${patientName} on ${date} at ${time}`
          }
        });
      } finally {
        locked.delete(slotKey);
      }
    }
  }

  // Acknowledge other events
  res.json({ received: true });
});

// Health check
app.get('/health', (req, res) => {
  res.json({ 
    status: 'ok',
    bookedSlots: slots.size,
    lockedSlots: locked.size
  });
});

const PORT = process.env.PORT || 3000;
app.listen(PORT, () => {
  console.log(`Server running on port ${PORT}`);
  console.log(`Webhook URL: http://localhost:${PORT}/webhook/vapi`);
});

npm install express

export VAPI_SERVER_SECRET="your_server_url_secret_from_dashboard"
export PORT=3000

node server.js

ngrok http 3000